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Incrementally maintaining a qualitative understanding of physical system behavior based on 
observations is crucial to real-time process monitoring, control, and diagnosis. This paper de¬ 
scribes the DATMI theory for dynamically maintaining a pinterp-space , a concise representation 
of local and global interpretations consistent with the observations over time. Each interpreta¬ 
tion signifies alternative paths of states in a qualitative environment. Representing a space of 
interpretations, instead of just a ^current best* one, avoids the need for extensive backtracking 
to handle incomplete or faulty data. Domain-specific knowledge about state and transition 
probabilities can be used to maintain the best working interpretation as well. Domain-specific 
knowledge about durations of states and paths of states can also be used to further constrain 
the interpretation space. When all these constraints lead to inconsistencies, faulty-data hy¬ 
potheses are generated and then tested by adjusting the pinterp-space. The time and space 
complexity of maintaining the pinterp-space is polynomial in the number of measurements and 


environment states. 
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Chapter 1 

INTRODUCTION 


The problem of interpreting observations of a system over time is fundamental to intelligent 
reasoning about the physical world. Diagnosis, for example, requires the ability to determine 
whether a system is operating as expected. Diagnosis also involves determining whether pre¬ 
dicted consequences of hypothesized faults could account for the original observations. Mon¬ 
itoring the execution of planned operations requires determining if actions actually have the 
desired effects. Process control demands, in real-time, an understanding of what is, or might 
be, happening in the physical system. Finally, model refinement requires determining when 
and how the predictions of the current model might conflict with the observations. 

Several factors make such interpretation tasks difficult: 

• An appropriate system model is required to meaningfully interpret the observations. For 
tracking behavior over time, this model must indicate the temporal ordering constraints 
on system behavior, 

• Typically, the available sensors provide only incomplete, possibly even faulty, data about 
the state of the system at each time. There may be many alternative interpretations 
consistent with such incomplete data - and they might all be incorrect if some data are 
faulty. 

• Measurements must be carefully translated into the language of the model. Such trans¬ 
lations should strive to minimize the effects of faulty data while preserving useful data, 

• Real-time interpretation of incomplete or faulty data requires the ability to incrementally 
re-interpret, without excessive backtracking, as observations are made. 

1.1 Thesis 

This paper presents the Dynamic Across-Time Measurement Interpretation (DATMI) theory for 
interpreting observations. It is based on a representation, called the pinterp-spacc (possible 
interpretation space), that indicates which system states might be occurring at each time ac¬ 
cording to the observations and the model. Each path of states across time represents an 
alternative interpretation. This pinterp-space stores the best current global interpretation and 
efficiently supports queries about alternative global interpretations and partial interpretations. 
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By indicating every state which might be occurring at each time, instead of just indicat¬ 
ing a few consistent sequences of states over time, the pinterp-space concisely represents the 
entire consistent interpretation space. DATMI uses this implicit representation of the entire 
interpretation apace to: 

X. Detect whether a particular state S could have occurred at a particular time t - this is 
especially useful for monitoring tasks, 

2. Interpret incomplete (potentially garden-path) observations - by using the least-commitment 
strategy of not discounting alternative consistent interpretations. 

By dynamically maintaining the pinterp-space as observations are obtained, DATMI also: 

1. Quickly provides a best working interpretation at all times. 

2. Detects faulty observations as soon as inconsistencies arise. 

3. Handles faulty observations by adjusting the pinterp-space to reflect changes in belief for 
some of the observations. 

DATMI can also use the following domain-speciflc information: 

1. Duration estimates for states and paths of states - which provide additional constraint 
on the pinterp-space. 

2. Likelihood or desirability estimates for states and state transitions - that indicate which 
interpretations are best. 

3. Probabilistic distributions over the states possibly indicated by a sensor reading - which 
help avoid inconsistencies due to faulty data. 

DATMI views observations as constraints on the interpretation space of possible behaviors 
implied by the system model. When the interpretation space implied by the model is large 
and only incomplete observations are available, an enormous number of interpretations could 
be consistent. Thus, explicitly generating all and only such valid interpretations is generally in¬ 
tractable and undesirable. The pinterp-space tractably represents an interpretation space which 
implicitly contains all consistent interpretations of the given observations while not covering 
any misinterpretations. Local constraint-propagation techniques are shown to be sufficient to 
ensure the consistency of the pinterp-space. 

Although the size of the interpretation space can be exponential in the number of system 
states, the entire DATMI algorithm involves only polynomial complexity. It requires space which 
is at most quadratic in the number of system states and Linear in the number of observations. 
Furthermore, processing time is at most cubic in the number of states and quadratic in the 
number of observations. In practice, processing time is often close to linear - making real-time 
interpretation feasible. 


1.2 The Role of Qualitative Physics 

Qualitative physics is well-suited for specifying models for interpretation problems since it 
stresses the causality and relevancy issues necessary for meaningfully explaining physical behav¬ 
ior. An overview of past and current work in qualitative physics can be found in (Forbus, 1988). 
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Qualitative simulation generates predictions of what qualitative changes a physical system might 
undergo. Such simulations can provide an interpreter with the necessary expectations of what 
behaviors are possible. 

A qualitative simulator, unlike a traditional numerical simulator, provides states 

which represent distinct states of the system’s variables. These qualitative states summarize 
system behavior at some relevant level of detail. Furthermore, qualitative physics is based on 
the notion of compatibility - that one can qualitatively simulate the physical system based on 
general-purpose domain models and additional knowledge of the organization of a particular 
system. Such composibility is useful for automated generation of models for specific physical 
systems and for refining models using machine learning. 

DATMI relies on the concept of a total environment (Forbus, 1984): 

Definition 1*1 (Total envisionment) A total envisionment represents all the possible qual¬ 
itative states of a system and all the possible transitions from one state to another. A path 
represents a sequence of states connected by these transitions . 

Thus, a total envisionment indicates all possible behaviors of the system. Alternatively, an 
attainable envtsionment represents only those states and transitions that arise from some initial 
state. 

Although attainable envisioners exist (Forbua, 1981; Kuipers, 1986), the ability to reason 
about total envisionments is important for interpretation since one may not know the exact 
state of the system when observations are first available. Unless otherwise noted, the term 
“envisionment” indicates a total envisionment. 

The Qualitative Process Engine (QPE) (Forbus, 1990) is currently used to provide total 
envisionments that represent the expectations of the model that the interpreter can use. The 
specific QP model used for our current DATMI examples is described in (Collins-4: Forbus, 1990). 


1.3 Overview of DATMI Theory 

The Dynamic Across-Time Measurement /nterpreiatian (DATMI) theory addresses several as¬ 
pects of the interpretation problem. It builds upon Forbus’ Across* Time Measurement In¬ 
terpretation (ATMI) theory (Forbus, 1986a). Both theories share an underlying theme that 
interpretation involves finding paths of states (global interpretations) through a qualitative en¬ 
visionment which are consistent with the observations. Any simulation technique providing such 
envisionments can be used to model the system; thus, both theories are ontology-independent. 

This section presents the basic DATMI framework and compares it to ATMI. Terminology 
introduced in this overview will be formalized later. As summarized below, DATMI inherits 
ATMI*s basic approach for converting observations into a representation from which global in¬ 
terpretations are generated. As shown in Figure 1.1, initial observations are first converted into 
qualitative property assertions over time intervals using domain-specific conversion rules. These 
properties each consist of a property name and a qualitative property value. These properties 
correspond to ones describing envisionment states. As these property assertions are gathered, 
global segments are maintained to concisely represent the observations qualitatively. 

The states of the envisionment that could possibly occur during each of these segments are 
indicated by the pinterp-space . Initially, all states whose properties agree with a segment's 
properties are considered possible in that segment. Local constraint-propagation techniques 
adjust the pinterp-space to eliminate state 5 as a possible state for global segment G whenever 
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Figure 1*1: DATMI modules and representations 

































it ib inconsistent for 5 to occur during G. Such inconsistency arises whenever there is no 
path of possible states of G, using only transitions in the environment, which connects 5 with 
one of the possible states of a segment temporally adjacent to G. An inconsistent pintcrp-space 
results whenever some global segment has no possible states, A pinterp-space being inconsistent 
indicates that either the observations or the model are faulty. 

DATMI extends the ATMI framework in several key ways. First, DATMI dynamically maintains 
a concise pinterp-space to provide efficient processing and to handle faulty data. Each possible 
state S of a segment G must have some compatibility relation with each segment temporally 
adjacent to G. Each relation indicates the (best) path of possible states of G connecting S to 
some poesible state of the adjacent segment. In the pinterp-space of Figure 1.1, for example, 
the compatibility relation between segment Seg3 and possible state 2 of segment Seg2 indicates 
a path going through possible state 9 of 3eg3 and connecting to possible state 3 of 5eg3, 
Furthermore, state 6 is not a possible state for 5eg2 because it cannot have compatibility 
relations with adjacent segments Segl and Seg3. 

The (best) working global interpretation can immediately be found at any time by combining 
these paths across each segment into a global path across all segments. Alternative consistent 
global interpretations can also be generated or confirmed by searching through this constrained 
pinterp-space. In contrast, ATMI always searched to find a global interpretation since it lacked 
the vocabulary of compatibility relations to immediately suggest one. 

DATMI addresses the problem of faulty data both at observation time and interpretation 
time. To reduce the effects of noisy data, DATMI allows conversions from measurements to 
qualitative data to be conservation (Le. disjunctive) and probabilistic. Furthermore, DATMI 
provides a means of recovery when such conversions still lead to an inconsistent pinterp-space. 
DATMI can dynamically adjust the pinterp-space baaed on hypotheses of what is wrong: the 
sensors, the conversions, or the envisionment itself. 

DATMI provides other advantages over ATMI as well. It provides efficient techniques for find¬ 
ing hidden-transition interpretations and gap-filling interpretations to account for incomplete 
observations. Such interpretations indicate state changes over a single segment that do not 
seem necessary according to the observations for that segment alone. For example, the global 
interpretation shown in Figure 1.1 involves a hidden-transition of state 2 followed by state 9 m 
segment Seg2. Also, as mentioned in Section 1.1, DATMI can use domain-specific duration and 
probabilistic estimates. 

It should be noted up front that some important interpretation problems are not addressed 
in this work. DATMI assumes that the model (envisionment) is complete and consistent. It 
ignores the problem of sensor fusion by assuming that only one sensor can indicate the value 
of a particular system variable at a particular time. It also ignores the problems of active data 
acquisition (Le. finding new data to reduce ambiguity) and data selection (Le. considering the 
best subset of data that can be processed under current resource constraints). However, the 
incremental capabilities of DATMI would allow it to incorporate new data or model constraints, 
or to retract existing ones, at any time. 


1.4 Overview of This Paper 

Chapter 2 discusses the initial phase of maintaining the observational history. It describes 
problems and approaches for converting numerical data into concise segments of qualitative 
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descriptions of the observations, along with how the reliability of sensor readings is taken into 
account* 

Chapter 3 defines the pinterp-space and how it is maintained to concisely represent the 
possible behaviors consistent with the observations and system model* Furthermore, the notion 
of path-coats is introduced to determine the overall “best* global interpretations* 

Chapter 4 explains how faulty data can arise and how they are handled* This chapter also 
discusses a method for retracting a faulty data hypothesis which is found to be inconsistent 
with later observations* 

Chapter 5 shows how path-costs can be generalized to include probabilistic measures of 
path likelihood. As shown in this chapter, normalizing these probabilistic measures involves 
recovering the probabilistic weight that was assigned to interpretations which are inconsistent 
with the observations* This allows the determination of interpretation likelihoods that are 
conditional on the observations* 

Chapter 6 describes how duration estimates for envisionxnent states and paths of states can 
reduce the ambiguity in the pinterp-space* After showing that applying these constraints to 
the entire pinterp-space is exponentially expensive, it discusses heuristics for applying them to 
a restricted number of useful cases* 

Chapter 7 analyzes the algorithmic complexity of DATMI’s maintenance procedures, indicates 
worst-case complexity, and discusses trade-offs in optimizing expected performance* 

Chapter 8 summarizes the DATMI framework, discusses how it relates to other work, and 
suggests future work* 

Finally, the Appendices demonstrate the performance of the LISP DATMI program on various 
examples* 
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Chapter 2 


MAINTAINING THE 
OBSERVATIONAL HISTORY 


The choice of representation for observations greatly influences the difficulty of interpretation. 
Overly conservative translations from numerical measurements to qualitative terms can lead 
to intractably large interpretation spaces. On the other hand, overly precise translations can 
prevent accurate interpretation. This chapter discusses how DATMI represents observations to 
try to avoid these two problems. Later chapters show how DATMI recovers from such problems 
when they still arise. 

The behavior of a physical system over time is often represented qualitatively with parameter 
histories (Forbus, 1984; Hayes, 1985): 

Definition 2*1 (Parameter history) A parameter history corresponds to a set of predicates 
describing the relations among object parameters over time. Each episoH* of this history indi¬ 
cates a set of predicates f for a particular spatially-bound collection of objects, whose truth values 
are constant over the episode's duration . Similarly, an event is an episode whose duration is 
an instant. 

Two episodes meet when the time interval of one follows the time interval of the other, with no 
time in between (Allen, 1983). Each predicate indicates the qualitative status of some system 
property - such as whether a certain pipe connects two particular containers, whether the water 
level of one container is greater than, less than, or equal to the water level of another container, 
or whether the temperature of a furnace is increasing, decreasing, or remaining constant. 

The following definition adapts Williams’ notion of concise histones (Williams, 1986) In 
terms of these parameter histories: 

Definition 2.2 (Concise history) A concise history merges meeting episodes unth identical 
truth-value assignments for corresponding sets of predicates and globally merges episodes that 
correspond to identical time intervals for different sets of predicates. 

Figure 2.1 presents several alternative history representations for the same behavior. 

In interpretation tasks one must distinguish the observational history from the behavioral 
history. The behavioral history corresponds to the traditional use of the term “history*: 

Definition 2*3 (Behavioral history) A behavioral history represents the actual complete be¬ 
havior of the physical system over time * 
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Where**: 

Definition 2.4 (Observational history) An observational history represents the observed 
changes in system variables. 

Thus, unlike a behavioral history, an observational history need not completely specify all the 
variables. Furthermore, an observational history might even be inconsistent with the behavioral 
history due to faulty data. 

In order to summarize the changes in each predicate over time, while maximizing the tem¬ 
poral extent of individual predicates, the behavioral history is best represented as a concise 
history. Likewise, an observational history should also be concise. However, a more useful 
representation for an observational history is a: 

Definition 2.5 (Globally-segmented concise history) A globally-segmented concise his¬ 
tory is a concise history where episodes never overlap temporally. 

This representation was also used by ATMI. In such a representation, the envisionment states 
which might be occurring at a particular time can be found by checking which states have prop¬ 
erties that are compatible with the property values in the episode covering that time. Forbus 
formalizes such relationships between histories and total envisionments in (Forbus, 1987). 

2.1 Representing the Observational History 

Formalizing DATMI’s use of globally-segmented concise histories first requires some definitions: 

Definition 2.6 (Global segment) The episodes of globally-segmented observational histories 
are called global segments, or just *segments * for short. 

The function START-TINE(G,) denotes .the time at which segment G s starts and END-TIME(Gg) 
denotes the time at which it ends. Furthermore, DORATION(G 0 ) indicates the length of time 
over which G, lasts, where DURATION(G y ) = END-TIME(G„) - START-TIME(G,). 

Each segment G g specifies a set of qualitative properties, (SEG-PRDPS(Gj)) holding over G’s 
time interval, each defined as follows: 

Definition 2.7 (Segment property) Each segment property consists of a property name, 
such as ORDER( Water-Level (Canl) ,Water-Level (Can2) ), and a property value, such as 
GREATER. The function PRQP-VAL(!P,p) = v denotes property value v for the property named 
p in the set of properties P. 

Segment properties concisely and more uniformly express the predicates of an episode; a single 
property with k possible values replaces k different predicates. 

The observational history H is a temporally totally-ordered sequence of these segments, as 
defined by: 

Definition 2.8 (Gj meets G r ) Two global segments meet when the time interval of one fol¬ 
lows the time interval of the other, with no time in between. The expression Gj j G r denotes 
that segment G{ meets G r . 

Definition 2.9 (Gj leads to G r ) Gj leads to G r , denoted G| G r , exactly when either 
EHD-TIME(G ( ; < START-TIME (G r ) or Gj | G r . 
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Definition 2.10 (Temporally totally-ordered segments) All segments of X are tempo¬ 
rally totally-ordered exactly when, for all fairs of distinct segments Gi and Gj of X, exactly 
one of the following is true: Gi Gj, Gj G, 

Each segment of )l is linked to its neighboring segments by the following two functions: 

Definition 2.11 (B-neighbor) The backward neighboring (b-neighboringj segment of a seg¬ 
ment G g is referred to as b-neighbor (G # ), where: b-neighbor(G f ) = G* = G* j G g . 

Definition 2.12 (F-neighbor) The forward neighboring (f-neighboring ) segment of a segment 
Gg is referred to as 1 -neighbor(G a ), where: i -n«ighbor(G f ) = G/ = G a | G/. 

Notice that neighboring segments of X always meet each other. 

Furthermore, the two end-points of X are identified aa: 

D efini tion 2.13 (Frontier segment) Segment G t is a frontier segment if either: 

j3/ € X b-neighbor(Gj) = / or fir € X 1 -neighbor(G a ) =■ r. 

The first and last segments of X are called frontier segments since they are the outer fringes of 

X. 

Sometimes there are intervals over which no observations are available: 

Definition 2.14 (Gap-fill segment) For any segment G a , SEG - PROPS (G a ) =0 exactly when 
Gg is a gap-fill segment. 

To minimize complexity, consecutive gap-fill segments are forbidden. Thus, for gap-fill segment 
Gg , the expression Gi | G, | G r , indicates the backward and forward non-gap-fill neighbors of 
Gg, The shorthand notation Gj || G r indicates that either Gj | G r or G| j G g | G r , for some 
gap-fill segment G s . 

It should be noted that the temporal total-ordering of X precludes general temporal rela¬ 
tions, such aa “Property X holds sometime during the time period from tl to t2 in which prop¬ 
erty Y holds", allowed in other temporal representations (Allen, 1983) (Williams, 1986). 
However, for many interpretation tasks, reasonably accurate time-stamps for the measurements 
are available, providing temporal total-orderings. Furthermore, the computational overhead as¬ 
sociated with reasoning about partial temporal-orderings may often be too high 1 , 

Values for particular properties may be ambiguous due to noisy data. One could simply 
ignore such noisy data altogether and just use unambiguous observations. However, that would 
be overly conservative since even noisy data provides some constraint. For example, suppose 
the numerical values of a series of measurements indicate that a system variable is decreasing 
or steady. In that case, one at least knows that it is not increasing. DATMI allows disjunctive 
property values to represent such cases. 


'Section 8.3.2 discusses some idea* for dealing with partial temporal-orderings. 
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2.2 Specifying Observations and Measurements 

Observations fall into two categories: numerical measurements and symbolic observations. Mea- 
surements are specified as: 

Definition 3.15 (Measurement) MEASURED.r.t.i.c) indicates the numerical (real) value 
r for the numerical property named n woe measured at time t, by the measuring instrument i, 
with probability c J . 

Alternatively, symbolic observations are specified as: 

Definition 2.16 (Observation) OBSERVER,v,tl.t2,s,e) asserts that the qualitative prop¬ 
erty named p has value v over the time period from ti to ij, according to source s, with probability 

c. 

Some states of the environment must mention the qualitative properties indicated by the 
observations to allow comparisons. The numerical properties indicated by measurements are 
translated into appropriate qualitative properties, as explained in the next section. 

2.3 Converting Measurements into Qualitative Properties 

To interpret measurements at instants, they must be translated into qualitative properties hold¬ 
ing over periods of time. DATMI’s translation methods attempt to provide qualitative properties 
which is neither uselessly weak nor more certain than the data warrants. These methods require 
domain-specific knowledge, as described below. They also require that the original analog data 
has been smoothed, using traditional techniques such as Gaussian convolution or least squares 
methods. 

Domain-specific knowledge first specifies which sets of numerical properties map into particu¬ 
lar qualitative properties. For example, numerical properties for Water-Level-1 and Water-Level-2 
are both required to determine the qualitative property QRDER(Water-Level-Canl, Water-Level-Can2). 
Of course, a qualitative property might result from alternative sets of numerical properties, es¬ 
pecially if multiple sensors are used. For example, suppose two sensors yield measures A1 
and A2 respectively for some quantity A and two other sensors yield measures SI and B 2 
respectively for some other quantity B. The qualitative property ORDERCA.B) could then be 
determined by any of the four possible comparisons of A1 or A2 with B 1 or B2. However, 
the current DATMI implementation does not handle multiple, conflicting, qualitative property 
assertions. 

DATMI also uses domain-specific quantity-space conversion tables which specify how these nu¬ 
merical measurements are to be mapped into qualitative properties by accounting for the preci¬ 
sion and accuracy of the sensors. For instance, for qualitative property aRDER(Water-Level-Canl. 
Water-Level -Can2) with possible values GREATER, LESS, or EQUAL, there must be numerical 
cutoffs for the relative ratio of the numerical values of Water-Level-1 and Water-Level-2 that 
determine which is actually greater. Figure 2.2 gives an example conversion table for each of the 
two general classes of properties that can result from measurements. As this figure illustrates, 
each conversion table can be weighted with discrete probabilities for each alternative value. 

Those probabilities must be supplied by external domain-specific means, perhaps based on the 
accuracies of the sensors. Otherwise, DATMI assumes all values are equally likely. 

2 MEA SURE is like ATMI’a He Mured predicate, except that it allows some confidence to be specified as well. 
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ORDER (Water-Lav®II,Wmt®r-Level2): 

If relative ratio of Water-Levell to Water-Level? la: 

* oo to -0,1 => (LESS with probability 1,0) 

-0,1 to 0 => (LESS with prob 0.3) V (EQUAL with prob 0.2) 

0 to 0 => (EQUAL with prob 1,0) 

0 to 0.1 => (GREATER with prob 0.8) V (EQUAL with prob 0.2) 

0.1 to oo => (GREATER with prob 1.0) 

CHANGE (Temperature (Can)) : 

If alope of change in Temperature (Can) is; 

- co to -0.1 (DECREASING with probability 1,0) 

-0,1 to 0 => (DECREASING with prob 0.7) V (STEADY with prob 0.3) 

0 to 0 (STEADY with prob 1.0) 

0 to 0.1 => (INCREASING with prob 0,7) V (STEADY with prob 0.3) 

0,1 to oo => (INCREASING with prob 1,0) 

Figure 2*2: Example quantity-space conversion tables 

For these mappings, the relative ratio of xl to x2 is 3 or just xl if x2 = 0. The slope of 
change in property P is simply — vt x )f(t2 ” h), where tl < t2 and v t is the value of P at 
time £. 

Another way that DATMI reduces the effects of noisy data is through the use of noise win¬ 
dows defined for each property. Each window indicates how many measurements on each end 
a of measurement sequence are required to feel confident that the inner measurements are 
qualitatively accurate. Each sequence consists only of: 

Definition 2.17 (Close data) Data which are temporally *close enough* that hidden quali¬ 
tative changes between any two data points could not occur are called close data. 

With a noise window of size two, six close measurements for times t 1 to (Mi, M^, Ms, M4, Ms, Ms), 
each mapping into an assertion that property p has value u, would only result in a single prop¬ 
erty assertion: p is v over the interval £3 to £4, Thus, the noise window helps ensure that a 
property is only asserted when enough closely neighboring measurements support it. 

Figures 2.3 and 2.4 illustrate how measurements are translated into property assertions for 
the two general classes of properties. As Figure 2.4 indicates, ORDER properties can even be 
determined over time intervals where the numerical properties are not measured at correspond¬ 
ing times, by identifying trends over close data. For example, one can see that the value of 
property A is greater than that of property B from points x to y because at the later point z 
the value of A is still greater than that of B. However, also note that the ORDER property for 
A and B from point y to z cannot be determined since the measurement points do not indicate 
whether point / is before or after point z. 

Even if noisy data are not a concern, a window size of one is still required to address the 
observation correspondence problem. This problem can arise whenever not all properties have 
measurements at the same times. Figure 2.3 shows an example of this problem. In this example, 
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Figure 2,3: Translating measurements to CHAUGE properties 


change at point x occurs before the point y at which the change is first observed. If the window 
size was zero, then the preceding increase in property A would be asserted up to point y . The 
property assertion from point x to point y would then be incorrect. During global segmentation, 
this could cause correspondence errors with other property assertions between points a: and y. 

Which data are close is determined by using domain-specific sample-time boundaries for 
each qualitative property p , called MIN-ST(p) and MAX-ST(/?). Data points temporally closer 
than MIN-ST(/>) are completely believed to be close. Data points farther apart than MAX*ST(p) 
are not even considered as part of the same qualitative property interval since they aren’t nearly 
close enough to warrant any assumption of continuity 

2.4 Creating, Merging, and Splitting Global Segments 

If a new property assertion is over the same interval as an existing segment, then the property 
is just added to that segment’s set of properties. However, assertions can also cause the history 

3 Data point* whose distance* axe between MIN-ST(p) and MAX-ST(p) could have some confidence level of being 
do*« which is proportional to the ratio of that distance and the difference between the MAX-ST(^) and MIN-ST(p). 
These confidences could be combined with the probabilities of property value* given by the quantity-space 
conversion table*. However, DATltl currently provides no approach for doing this. 
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Figure 2*5: Splitting segments when asserting a property 


to be reorganized. This reorganization can invoke three kinds of operations: creation, splitting, 
and merging. 

If the assertion interval occurs after (or before) all existing segments, then a new segment 
G n must be created with SEG-PROPS (G n ) containing just the new property. If this new interval 
is outside of the current history (past a frontier segment) then a gap-fill segment is also created 
to represent the interval between the old frontier segment and the newly created one. 

A new qualitative property assertion may temporally overlap a portion of an existing seg¬ 
ment. Such overlaps require splitting the overlapped segment into two smaller segments: one 
containing the new property and one that does not. Furthermore, assertions which cover several 
segments must have the property added to each of the covered segments, with any partially 
overlapped segments on either end of the assertion being split appropriately. An example of 
segment splitting is presented in Figure 2.5. 

Neighboring segments which represent the same properties must be merged to keep the 
observational history concise. Figure 2.6 illustrates the effects of merging segments. Such 
merging involves temporally extending the earlier of two neighboring segments to cover the 
time interval of both segments and then discarding the other segment. 

Actually, merging should not always occur when two neighboring segments have identical 
properties- The probabilities of the properties, which are determined when translating mea¬ 
surements into qualitative properties, should also be comparable - not just the property values 
themselves. Merging two segments which differ greatly in their probabilities for a particular 
property would lose information essential to later backtracking to handle faulty data. This 
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Figure 2.6: Merging segments to maintain a concise history 


suggests partitioning a concise history episode into segments with qualitatively distinct proba¬ 
bilities for such properties. This partitioning would require domain-specific criteria that indicate 
when two probabilities for a property were significantly different. Although DATMI currently 
does not perform such partitioning, it does ensure that the probability of a merged property is 
the minimum of the levels in the two merging segments, to avoid overestimating the confidence 
in the observations. 
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Chapter 3 


MAINTAINING THE 
PINTERP-SPACE 


The interpretation space maintained by DATMI indicates all of the envisionment states that 
could actually occur during each of the global segments* A particular state that can occur 
in a particular segment is called a ptnterp (Forbus, 1986b) because it indicates a “possible 
interpretation” for that segment* DATMI refers to these pinterps as follows: 

Definition 3,1 (Pinterp) P(G gi S a ) denotes the pinterp which indicates that state S, can 
occur some time during segment G g . 

The interpretation space consisting of these pinterps is referred to as the pinterp-spacc. 

For simplicity, this paper will sometimes just refer to a pinterp to indicate its state or 
segment, if this is unambiguous. Usually, such references indicate a state. For example, a path 
of states is said to pass through a pinterp if it passes through that pinterp 1 ? corresponding 
state. However, two cases refer to the segment instead: 

Definition 3*2 (Neighboring pinterps) Pinterps P(G g ,S a ) and P(G ni Sb) are co/fed neigh¬ 
boring pinterps exactly when G g \ G n or G n ] G g (ie. they correspond to neighboring segments). 

Definition 3.3 (Same-segment pinterps) Two pinterps P(G gt S a ) and P[G nj 5&) are called 
same-segment pinterps exactly when G g = G n (ie. they both correspond to the same segment). 

Maintaining the set of all states that could occur in a segment avoids the unnecessary 
expense of instead maintaining the set of all state paths spanning that segment that consist only 
of these states. Indeed, many typical interpretation tasks, such as monitoring, are concerned 
only with whether a system could be in some particular states. Even tasks requiring global 
interpretations, such as explanation, typically only need the best current global interpretation. 
Storing all such paths is typically also impractical. In fact, as noted in (Forbus, 1986a), there 
may even be an infinite number of such paths if there are cycles in the envisionment. 

Nevertheless, DATMI does explicitly represent certain significant paths of states across seg¬ 
ments, including those which together form the best current global interpretation* Pinterp 
dependencies are associated with each pinterp P{G gt S a ) to indicate a possible path of states 
across G g which passes through P(G g ,S a ) while connecting a pinterp in b-neighbor(G^) with 
a pinterp in f -neighbor(G g ). So, the pinterp dependencies for a pinterp P(G # , S a ) indicate one 
possible behavior for G g that has S a occurring in G g . These dependencies serve two functions: 
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1. They explicitly provide, at all times, the current best global interpretation ending at each 
pinterp. 

2. They indicate which pinterp* must be re-supported when a particular pinterp becomes 
inconsistent. 

Supporting pintarps with these dependencies is analogous to supporting nodes with justifications 
in truth-maintenance systems (Doyle, 1979). 

This chapter describes how DATMI incrementally maintains pinterp dependencies as new 
observations are obtained. 

3.1 Consistency Constraints and Classes of Pinterps 

DATMI uses symbolic relaxation (Waltz, 1972; Mackworth Sc Freuder, 1985) to construct glob¬ 
ally consistent interpretations from local constraints. In such approaches, the constraint net¬ 
work is a graph of nodes, each representing specific variable assignments. These nodes are 
connected by area reflecting local constraints on the values of variables. A complete solution is 
a connected subgraph with one node for each variable which indicates a set of variable assign¬ 
ments satisfying the constraints. 

Each DATMI global segment plays the role of a variable and the states provide the values. 
The pinterp P(G fJ S a ) represents the variable assignment of a state S a to a segment G g . Each 
variable assignment (pinterp) must satisfy two types of local consistency constraints: 

Definition 3.4 (Property contraints) A pinterp P{G g% S 3 ) satisfies the property constraints 
exactly when the properties of state S 9 are compatible with the properties of segment G g * A pin¬ 
terp which satisfies the proper fy constraints is called property consistent. 

Definition 3.5 (Transition constraints) A pinterp P(G g ,S,} satisfies the transition con¬ 
straints exactly when being in S $ during G g is consistent with being in both: some state during 
b-neighbor(Gj) and some state during l-neighbor(G 9 ). A pinterp which satisfies the tran¬ 
sition constraints it called transition consistent. The envisionmenVs state transitions and the 
set of pinterps satisfying all consistency constraints together define the transition constraints . 

The status of a pinterp P(G §f S t ) indicates whether the variable assignment of S 3 to G g is 
consistent, as follows: 

1. INCOMPATIBLE - S s cannot occur in G g because it is not property consistent 1 . 

2. INACTIVE - S, cannot occur in G g because it is not transition consistent. 

3. ACTIVE - S 9 can occur in G g . 

4. UNKNOWN - consistency has not been checked. 

Definition 3.6 (Filtering and activating pinterps) The process of changing the status of 
a pinterp from ACTIVE to INACTIVE is referred to as filtering that pinterp (from the set of ACTIVE 
pinterps). Similarly t activating a pinterp means changing its status to ACTIVE. 


3 Thft DATMI implementation actually discard* all INCOMPATIBLE pinterps to save space. This requires re- 
creating some pinterps if some segment properties are later discarded as possibly faulty data. 
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Pinterp. which are either ACTIVE or INACTIVE are also called COMPATIBLE, since they satisfy 
the property constraints. All pinterpe satisfying the property constraints are initially assumed 
ACTIVE and are then later filtered if they violate the transition constraints. 

Only ACTIVE pinterpe participate in pinterp dependencies. Whenever a pinterp becomes 
INACTIVE, all the pinterpe depending on it must re-satisfy the transition constraints, which 
gives them new dependencies. Those pinterpe which cannot re-satisfy the transition constraints 
become INACTIVE themselves, propagating the effects of the original filtering. 

UNKNOWN pinterpe refer to states which are not currently being considered. It may be de¬ 
sirable to ignore some pinterpe when the envisionment is very large, observations are very 
incomplete, or those pinterpa are very implausible. The current DATMI implementation does 
not provide means for labeling pinterpe as UNKNOWN. 


3.2 Types of Transition Consistency Relations 

This section discusses the ways that the transition constraints can be satisfied. The five types 
of transition consistency relations between a pinterp and a neighboring segment are referred 
to as: frontier-state , spanning-state y meeting-states, hidden-transition , and gap-filling. Fig¬ 
ure 3.1 illustrates each type. Each transition consistency relation indicates a path of ACTIVE 
pinterpe starting at the given pinterp P(G §t S t ) and reaching a pinterp in b-neighbor(Gj) 
or f -neighbor (G g ), A pinterp P(G gj S 9 ) satisfies the transition constraints exactly when 
P(G gj S 9 ) has at least one transition consistency relation with f-neighborg and at least one 
with b-nelghborg. If a neighboring segment is a gap-fill segment, then the b-neighbor or 
1 “'neighbor, respectively, of that gap-fill segment is instead used for these relations. 

Frontier-state consistency refers to the special case where the pinterp 7 s segment is a fron¬ 
tier segment and the neighboring segment does not exist. 

Spanning-state consistency for a pinterp P(G g ^S 9 ) occurs when the pinterp for S s in 
the neighboring segment is ACTIVE. S 9 can then persist (“span*) from G 3 to the neighboring 
segment. This can occur only when the properties of one segment p-subsumes the properties of 
a neighboring segment, according to the following definition: 

Definition 3.7 (P-subsumption) For any disjunctive property values vl and v2 r vl is more 
general than v2 exactly when PWP-VAL(P,p) =z v2 => PROP-VALfF,p,J - vL Property set P 
p-subeumes property set Q exactly when , for all p 6 P, PROP-VAL/T^p) ^ 0 PROP-VAL/Q^ 
is more general than FROP-VALfP,p^. 

DATMI prefers spanning-state relations because they indicate paths which best meet the simplest 
action assumption (Forbus, 1984). 

Meeting-states consistency occurs when there is a state transition from the given pinterp 
to an ACTIVE pinterp in the neighboring segment. 

Hidden-transition consistency for a pinterp P(G gt S 9 ) occurs when there is a path of 
ACTIVE pinterpe of G 9 connecting P{G g , 5,) with an ACTIVE pinterp of the neighboring segment. 

Gap-filling consistency for a pinterp P{G if S 9 ) occurs when there is a path, of any envi¬ 
sionment states, which connect P{G gi S 9 ) with an ACTIVE pinterp in the neighboring segment. 


19 



F rentier-State 



0>— 

— Q> 


Spanning-State 


0— 



Meeting-States 


m 




Hidden-Transition 

g»p-fill segment 








Gap-filling 


Figure 3.1: Examples of the five DATMI transition consistency relations 

An example path from state l to a state of the f-neighboring segment, if any, is given for each 
case. Each box represents a segment and each circle represents an ACTIVE pinterp in that 
segment corresponding to the numbered state. Each arrow corresponds to a state transition. 
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3.3 Representing Transition Consistency Relations With De¬ 
pendency Paths 

For each ACTIVE pinterp and a neighboring segment , DATMI caches only the path Indicated by 
the best transition consistency relation between that pinterp and segment. These two paths for 
each pinterp provide its pinterp dependencies as follows: 

Definition 3*8 (Dependency paths) A dependency path for some pinterp P(G f ,S $ ) rcprc- 
* seat# the path of pinterp* indicated fry the beet transition consistency relation between P{G gj S $ ) 
and a neighboring segment The dependency path of P(G gj S M ) connects P(G gf S B ) with a 
pinterp in f-n«ighbor(<3 ? ) and the b-dependency path of P(G g> S M ) connects P(G fl ,S t ) with 
one in b*nelghbor(G 7 ). 

Since DATMI only considers acyclic interpretations over each segment, each dependency path 
consists of no more than N states, where N is the number of envisionment states. 

3.3.1 Caching Exactly Two Dependency Paths Per Pinterp Is Best 

DATMI caches the path of the best transition consistency relation between each pinterp and 
neighboring segment because it can directly contribute to the best working global interpretation. 
Furthermore, by caching these paths as the pinterp dependencies, the pinterps need not be 
re-satisfied with the transition constraints unless one of the pinterps in those paths becomes 
INACTIVE. 

Caching alternative paths as well, each representing less-optimal transition consistency re¬ 
lations, would not lead to the efficiencies that one might expect. In order to provide best global 
interpretations, a dependency path that becomes inconsistent with the transition constraints 
must be replaced with the best consistent path. Selecting which cached alternative to use as 
the new best path will typically cost as much as full search for a new dependency path. This 
is because such selection involves search itself, to verify that this alternative is now the best. 

Even if the best global interpretation was not required, caching alternatives is still undesir¬ 
able. Since the search algorithms discussed in Section 3.7 are so efficient, the overhead in always 
keeping track of which cached alternatives are consistent is typically unnecessary. Also, one 
cannot expect a manageable-sized set of cached alternatives to even contain a consistent one, 
since the number of them can be exponential in the size of the envisionment (see Section 7.2). 
So, even postponing consistency verification until needed is typically not worth the overhead. 

Caching alternative paths could only be worth it if they involve many states and one could 
determine that they were much more likely to be consistent with the expected observations 
than most other acylic paths through the envisionment. However, such a determination would 
require search over the exponential number of paths through the envisionment. 

3*3*2 Some Example Dependency Paths 

To simplify discussions, the following dependency relations among pinterps are defined: 

Definition 3.9 (Pinterp dependency relations) A pinterp P(G gj S $ ) depends exactly on 
those pinterps in its two dependency paths . It f-depends only on the pinterps in its f-dcpcndency 
path (except P[G gi S a ) itself) and b-depends only on the pinterps in its b-dcpendency path 
(except P{G g ,S t )). 
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Enviaionment: 





Figure 3*2: Example of pinterp dependencies 

For piaterp-apace: Boxes represent segments, circles represent COMPATIBLE pinterps corre¬ 
sponding to the numbered states, and thick arrows indicate state transitions in f-dependency 
paths. Note that the (thin) b*dependency arrows point in the reverse directions of the state 
transitions, to show the reversed direction of dependency. 

For envisiomnent; Circles indicate states and arrows indicate transitions. 


Figure 3*2 shows example dependency paths in part of a pinterp-space. Each path is indi¬ 
cated by a sequence of arrows leading from one pinterp to a pinterp of a neighboring segment. 
Although pinterps P(Gi,Sa) and P(G 2j Sj) are both COMPATIBLE, they are also INACTIVE 
because they violate the transition constraints. Furthermore, the ACTIVE pinterp P(G 3j S\) b- 
depends on same-segment pinterp PfGi,^) and neighboring pinterp P(Gi,Sj) and f-depends 
on P(G 2 ,S s ), P(G 2j S i ) f and P(G 3 ,S 8 ). 

Note that, while each ACTIVE pinterp (except some frontier pinterps) must f-depend and 
b-depend on some pinterps, some pinterps may not have any pinterps f-depend or b-depend 
on them. For example, no pinterp in Figure 3.2 depends on P(G 2? 5 i) since the transition 
P(G 2j S 2 ) —* P(G 2t S z ) provides a shorter path from P(G 3 j Sj) to F(G 3 ,S 3 ) than FfGj,^) — 1 ► 
P(G 3 ,Sx) - P(G 2i S z ). 

Also, observe that an interpretation from Segment-1 to Segment-3 can be found simply 
by following either the chain of f-dependency paths from some ACTIVE pinterp in Segment-1 
or the chain of b-dependency paths from some ACTIVE pinterp in Segment-3. For instance, 
following the chain of f-dependency paths from pinterp P(Gi, 5e) in Figure 3.2 yields a working 
interpretation F(G lf S 6 ) - P(G l7 S 2 ) — P(G 2i S 2 ) P(G 2l S z ) — F(G 2 ,5 4 ) — F(G 3l S s ), 
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In this cue, following the chain of b-dependency paths from P(Gs, $%) would lead to the same 
interpretation. However, the backward and forward dependency paths need not be symmetric; 
in fact, Section 3.5 presents an algorithm for propagating costa of states and transitions which 
may result in asymmetric dependency paths. 


3.4 Maintaining Pinterp Dependencies 

The pinterf^space must be updated whenever a new segment is created or properties of existing 
segments are changed. The basic process of updating the pinterp-space involves two steps: 

1* Determine which pinterps become INCOMPATIBLE due to the new segment properties. 

2. Determine which pinterpa must now be filtered because they no longer satisfy the transi¬ 
tion constraints. 

Figure 3.3 shows the primitive functions used in pinterjvspace maintenance. 

DATMI uses essentially the same technique as ATM! to find COMPATIBLE-STATES (/*), the set of 
states compatible with a set of properties p. It uses the following lookup-table representation: 

Definition 3*10 (State lookup-table) A state lookup-table stores for each property name 
the set of states which are compatible with each possible property value . Given a set of properties 
p, it returns COMPATIBLE-STATES ip ). 

This table is easily generated horn the enviaionment off-line. A segment’s COMPATIBLE pinterps 
can be determined by intersecting the set of states compatible with each of the segment’s 
properties. Since DATMI property values can be disjunctive, the set of states compatible with a 
particular property is the union of the states compatible with each property value disjunct. 

3*4*1 Processing a New Segment 

A new segment G g is either a new frontier segment or part of what was a gap-fill segment. 
Gj is first assigned a set of pinterps compatible with its properties. Each of these COMPATIBLE 
pinterps starts as ACTIVE and is filtered if transition consistency relations cannot be found 
between it and its neighboring segments. These filterings are then propagated to the rest of 
the pinterp-space. Figure 3.4 gives the algorithm for processing a new segment. 

As shown in step 5 of this algorithm, care is taken to ensure that any pinterp of G g depending 
on a newly filtered pinterp of G g (due to a hidden-transition dependency path) is also filtered if 
no alternative dependency path cam be found for it. This step continues until no more pinterps 
of G g are filtered. Step 6 filters any ACTIVE pinterps of the neighboring segments that have no 
transition consistency relation with this new segment G g . Finally, in step 6d, the effects of any 
such filterings are propagated to the other segments. 

3.4.2 Processing an Updated Segment 

Whenever additional properties are asserted for a segment, some previously ACTIVE or INACTIVE 
pinterps can become INCOMPATIBLE. In this case, the ACTIVE pinterps which have become 
INCOMPATIBLE are treated as newly filtered pinterps of G a for the sake of propagating the 
effects of these incompatibilities. However, their statuses are not actually made INACTIVE. 
Figure 3.5 shows how this is accomplished. 
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These definitions hold for pmterpe P and P(G # , S,), global segment G g , set of properties p, and 
temporal direction d: 


SEG-PHOPS(Gj) = set of properties asserted for segment G g . 

COMPATIBLE-STATES (p) = {VS,-: 

Si is a state whose properties are compatible with p }. 

COMPATIBLE? (S,.p) <=> S, € COMPATIBLE-STATES(p). 

COMPATIBLE-PINTERPS (/»,G fl ) = { VP(G t ,Si): COMPATIBLE?(S,-, p) } 

STATUSCP) € {ACTIVE.INACTIVE,INCOMPATIBLE,UNKNOWN} 

ACTIVES(Gj) = {VP(G„Si): STATUS (P(G,, S,-))-ACTIVE} 

IN ACTIVES (Gj) = {iP{G f ,Si): STATUS <P(G 9 ,Si))-INACTIVE} 

ACTIVE? (P) <=> STATUS (P)-ACTIVE 
INACTIVE? (P) <=> STATUS CP)-INACTIVE 

REV-DIE(d) - BACKWARD if d - FORWARD, else FORWARD if d - BACKWARD. 

J 

DEPENDENCIES (P.d) - set of pinterps in P's b-dependeney path (except P) if ^-BACKWARD 

set of pinterps in P's f-dependency path (except P) if ^-FORWARD 

DEPENDING-ON(P.d) - {p: P € DEPENDENCIES(P.REV-DIR(d))} 

NEIGHBOR-SEGMENT(G a ,d) - G„ where: 

If d » BACKWARD then G n \ G g . 

If d - FORWARD then G } \G n . 

NON-GAP-FILL-NEIGHBORCGj, d) - G„ where: 

If d - BACKWARD then G n || G g . 

If d - FORWARD then G g || G„. 

FRONTIER-SEGMENT?( G s . d) <=> (d-BACKWARD A 0 | G g ) V (d-FORWARD A G g | 0). 


Figure 3.3: Primitive DATMI definitions 
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Given: new segment G t with properties SEG-PROPS(Gj). 

(Procedure FIND-DEPENDENCY-PATH is defined in Section 3.7. If no dependency path 
can be found for a pinterp, it returns lull and filters that pinterp. Otherwise it records the 
dependency path.) 


1. C «- COMPATIBLE-STATES(SEG-PROPS(Gj)). 

2. For S, € C do 

a. Create pinterp P(G g ,S ,). 

b. STATOSfPfGj,^,)) *- ACTIVE. 

3. I*— 0. ; the set of newly filtered pinterp* 

4. For S, G C do 

For d€ {BACKWARD. FORWARD} do 

a. Call FIND-DEPENDENCT-PATHCP(G„S.),d). 

b. If fail, /+- I\J P(G g ,S,). 

6. For P £ I do 

For de {BACKWARD,FORWARD} do 

For P{G k ,S,) e DEPENDING-ON(P,d) do 

: find alternative support for dependents of newly filtered ones: 

a. Call FIND-D£PENDENCY-PATH(F(Gfc, S t ),d ). 

b. If fail then / «— / U P(G*, S,) else / «— I — P(G k ,S ,). 

6. For d€ {BACKWARD,FORWARD} do 

a. G n — NON-GAP-FILL-NEIGHBOR(G , d) . 

b. f«— 0. 

c. For P(G„,S,)€ ACTIVES(G n ) do 

i. Call FIND-DEPENDENCY-PATH (PfG,,, 5,). d). 
ii. If fail, / 4 - / u P(G„, S.) . 

d. Call PROPAGATE-FILTERING-EFFECTS(G„./.d). 

Figure 3.4: Procedure CREATE-PINTERPS 


Given: segment G ff and set of new properties p € SEG - PROPS (Gj). 


1. I*— 0. ; set of newly incompatible pinterps 

2. For P{G g ,S t )€ ACTIVES(G„) do 

If not COMPATIBLE?(S,, p) 
then I *— I U P(G ( , S t ). 

3. For d€ {BACKWARD,FORWARD} do 

Call PROPAGATE-FILTERING-EFFECTS CG,,/,d). 


Figure 3.5: Procedure REFINE-PINTEHPS 






Given: seed-segment G s , set of newly filtered pinterps /, and direction d. 


1 , I* <—0 ; set of newly filtered pinterps of neighboring segaent 

2. For P El do 

For P{G kj S a )€ DEPENDING-ON(P f rf) do 

m. Call FIND-DEPENDEHCT-PATH(^(G*, S t ) ( REV-DIR(d) ) - 
b* If fail then 
If G k = G f 

then / I U (PfGfcjSj)} ; sore for current segment 
else /„-/u{P(G k ,S t )}. 

3. Unless 4* = 0 

a. G n «- NON-GAP-FILL-NEIGHBORCG^rf) . 

b. Call PROPAGATE-FILTERING-EFFECTS (G*. / ftl d). 

Figure 3.6: Procedure PROP AGATE-FILTERING-EFFECTS 


3.4.3 Propagating the Effects of Pinterp Filterings 

A central operation in the incremental maintenance of the pinterp-space is the propagation of 
pinterp filterings. The key to efficiently handling this propagation is to realize that only the 
pinterps that depend on one of the newly filtered pinterps can possibly be affected. Figure 3.6 
presents this propagation algorithm. 

Note that propagation consists of two sweeps, one backwards and one forwards, over the 
segments. During each sweep, all pinterps of the current segment G g which have no transition 
consistency relations with the neighboring segment G n are filtered before proceeding to G n . 
Once propagation reaches G ny the set of pinterps of G f that have transition consistency relations 
with G n cannot change. Thus, propagation need never examine segments more than once - 
uni-directional sweeps are sufficient. 

During the propagation of pinterp filterings, faulty observations or models may manifest 
themselves as follows: 

Definition 3.11 (Inconsistent segment) A segment which has no ACTIVE pinterps is said 
to be an inconsistent segment. 

An inconsistent segment indicates that no global interpretation is possible. To fix this problem, 
either the observations or the model must be modified. Chapter 1 discusses how DATMI performs 
such fixes. 


3.5 Path-Cost Maintenance 

The methods discussed so far ensure that the pinterp-space satisfies the property constraints 
and transition constraints. However, they do not ensure that the global interpretation indicated 
by the dependency paths is the best one. 
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DATMI solves this problem by associating with each pinterp a measure of the desirability of 
the global interpretation it indicates, as follows: 

Definition 3.13 (Path-cost) Suppose the b-dependency path of pinterp P(G g , S,) startt in 
the b-netgkboring pinterp P(G„,£ t ). Then, the path-cost of P{G s ,S,) is the sum of the cost of 
its b-dependency path and the path-cost associated with P(G„,5»). The path-cost of a pinterp 
in the first segment of the history is just the cost of its state. 

A pinterpa’s path-cost represents the cost of the entire chain of b-dependency paths sup¬ 
porting that pinterp, beginning with a pinterp in the first segment of the history. The cost of a 
b-dependency path is usually the sum of the costs of all its states and transitions, excluding the 
cost of the state of the b-neighboring pinterp in that path. The exception is that spanning-state 
b-dependency paths have oo cost, since the state does not change over that path. 

The state costs and transition costs should be conditioned on domain-specific preference 
criteria. For example, one may use these state costs to indicate how much more preferable 
states having value X for a property at to states having value Y. These costs could also be 
conditioned on the a pnon" probabilities that these states or transitions might occur. Path-costs 
based on such heuristic information would reflect reasons for favoring one global interpretation 
over another. 

Maintaining path-costs involves propagating the path-costs of a pinterp forward through 
the b-dependency paths. Forward propagation is preferred over backward propagation simply 
because observations typically come in temporal order, so most changes in the pinterp-space 
will occur in the later segments. In procedure REFINE-PINTERPS (3.5), the backward filtering 
sweep must be performed before the the forward filtering sweep to ensure that path-costs are 
accurate when they are propagated in the forward sweep. 

Propagating path-costs requires some changes to the PROPAGATE-FILTERING-EFFECTS pro¬ 
cedure (Figure 3.6), as shown in Figure 3.7. After finding a replacement b-dependency path 
for pinterp P(Gt, S t ) in step 2, it determines if P(Gk,S»)’s path-cost is now greater than when 
using the replaced dependency path. Notice that a pinterp’s path-cost never becomes lower here 
because better b-dependency paths can never result from having filtering some b-neighboring 
pinterps : . Once step 3 determines that no more filtering is necessary, it invokes the forward 
propagation of those path-costs increases. 

Path-cost propagation proceeds segment by segment, from the earliest affected segment to 
the latest affected segment, as shown in the algorithms of Figures 3.8 and 3.9. Note that step 4 
of PROPAGATE-INCREASES-TO""DEPENDENTS ignores pinterps of G # which b-depend on the current 
pinterp P(G„ S,) with increased path-cost. While PROPAGATE-INCREASES-TO-DEPENDENTS was 
propagating the effect of a path-cost increase from b-neighbor(G ff ) to P(G g ,S,), it would also 
propagate the path-cost increases to all other affected pinterps of G g . 

Unfortunately, it is not always adequate to define global path optimality in terms of the 
sum of the costs of dependency paths. Consider two alternative global interpretations of the 
same cost: one which has a hidden-tranBition and one that does not. The latter might be more 
preferable because it is simpler, by containing less states. In that case, one could get DATMI 
to prefer that simpler interpretation by slightly penalizing the costs of all hidden-transition 


’However, reactivating some b-neighboring pinterp* may result in better b-dependency paths. Since pinterp 
reactivations occur only due to change* in beliefs in the observations or model, the propagation of path-costs 
during reactivation is ignored anti] Chapter 1. 
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Given: seed-segment G t , set of filtered pisterps I, and direction d. 


1. I n 4 — 0. Q *— 0 

2. For P&I do 

For P(G k ,S,) 6 DEPENDING-QH(P,rf) do 

*. Call FIND”DEPENDENCT-PlTH(P(Gfc, S,) .REV-DIR(d) ) . 
b. II fail 
then 

H G k = G a 

then I <— 7u {P(G k , 5,)} ; more for current segment 

else I n *~ ID { P{G k ,5,)}. 

else 

If d * FORWARD and path-coat of P{G k ,S s ) has increased 
then ENQUEUE P(G k ,S t ) on Q. 

3. If Z« = 0 

then Call PROPAGATE-PATH-COST-INCREASES(Q) . 
else 

a. G„ — NGN-GAP-FILL-NEIGHBOR (G,.d) . 

b. Call PROPAGATE-FILTERING-EFFECTS(G„,I n ,rf) . 


Figure 3.7: Procedure PROP AGATE-FILTERING-EFFECTS (using path-costs} 


Given: stack S of pinterps having increased path-costs, ordered with pinterps of earlier segments 
nearer to the head. 


1. (J<-0 ; queue of pinterps affected 

2. P{G„Si)*- STACX-HEAD(5). 

3. PtG^Sy)*- qOEUE-HEAD(Q). 

4. If G q 'v* G, 

; stop propagation at the segment which is after the other: 
then Call PROPAGATE- INCREASES-TO - DEPENDENTS CG, ,Q ,Q) 
else Call PROPAGATE-INCREASES-TO-DEPENDENTS (G q .Q.S). 

; note that G, is never the same segment as G q 

5. Unless both 5 and Q are empty, Goto step 2. 


Figure 3.8: Procedure PROP AGATE-PATH-COST-INCREASES 
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Given: stop-segment G ti queue Q of affected pinterps, and data structure D which can be 
either a stack or a queue. 

Side-effects: changes contents of Q. 


» 


1. P(G B , S',)*— HEAD (£>) . ; a pinterp 

with increased path-cost 

2. If G, G a then exit ; since passed stop-segment 

3. POP or DEQUEUE head of D. 

4. For P(G k ,Si)€ DEPENDING-ON(P(G a , 5,) .BACKWARD) do 

When G* ^ G g 

a. FIND-DEPENDENCY-PATH (P(G k , S,-) .BACKWARD) . 

; always succeeds, otherwise filter propagation would have 
; filtered P(G k ,Sj) already 

b. When the new path-cost is higher than the old one 
i. If D is stack and <5 = 0 then G„ <— G g . 

; ensures that cycle from steps 1 to 5 exits at step 2 as soon 
; as all depending pinterps are processed at step 4 
ii.'Enqueue P(G k ,S;) onto queue Q. 

5. Unless D — 9, Goto step 1. 

Figure 3.9: Procedure PROPAGATE- INCREASES-TO-DEPENDENTS 
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dependency paths. However, problem# arise when there are global preference factors that 
cannot be handled by penalizing a dependency path, independent of which global interpretation 
contains it. For example, such global preferences might include partial-ordering constraints on 
interpretations* 

A related (and perhaps more serious) problem is that there could be other global interpretar 
tions with same cost as the best ones given by the txlependency paths. This is due to the fact 
that only a single best ^dependency path is recorded for each pinterp. Finding all alternative 
best global interpretations requires full search over all the ACTIVE pinterps. 


3.6 Global Interpretation Construction 

The construction of consistent global interpretations from the pinterp-space can be performed 
in a number of ways, depending on which of the following one wants to know: 

1 * What is the best global interpretation? 

2. What are the K best global interpretations? 

3. Can this particular path of states explain the data? 

4. Can this particular state occur during this particular period of time? 

To determine the best current global interpretation from times £i to £?, DATMI simply follows 
the chain of txlependency paths from the segment occurring at £i backwards to the segment 
occurring during t*. The segment for time £3 may have several ACTIVE pinterps, so the one 
with the lowest path-cost is used at the start of this chain. 

Search over all ACTIVE pinterps and all possible dependency paths is required to find the 
Jf best global interpretations. For every f-neighboring pinterp N for the pinterp P at the head 
of a partial search path, the path-costs of extending that path by each possible b-dependency 
path between N and P must be considered. Whenever the cost of extending becomes greater 
than the cost of any of the current K best search paths, search can terminate for that search 
path. 

Verifying that a particular sequence of states is consistent with the observations is much 
less expensive. Again, search is performed, but this time the given sequence of states strongly 
constrains what {-neighboring pinterps and dependency paths to consider. 

Determining whether a particular state could occur during a certain period of time is even 
easier: just check if there is an ACTIVE pinterp for that state for any of the segments occurring 
during that time. Such queries would be useful when monitoring for dangerous or otherwise 
interesting states, 

3.7 Finding Dependency Paths 

Finding a dependency path involves finding a transition consistency relation between a pin- 
terp and a neighboring segment. As shown in Figure 3*10, DATMI’s algorithm for finding a 
dependency path first determines which types of relations could possibly hold. When the best 
b-dependency path is being sought, path-costs are used to indicate which relation is best. When 
the f-dependency path is being sought, or when path-costs are not being used, DATMI just uses 
the first relation found* 
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Given: Pinterp P{G g , S,) and direction d 

Returns: status of finding a dependency path (ie. succeed or fail) 

1. G n — NEIGHBOR-SEGMENT(G # . cO . 

2. If G n — 0 

then Call FIND-FRONTIER-STATE-PATH in direction d for P(G g ,S 3 ) 

else 

if GAP-FILL-SEGMENT? (GJ 

then Call FIND-GAP-FILL-PATH in direction d for P(G„S,} 

3. Otherwise: 

Find a dependency path for P(G g ,S,) in direction d, by calling: 

a. FIND-SPANNING-STATE-PATH. 

b. FIND-MEETING-STATES-PATH, or 

c. FIND-HIDDEN-TRANSITION-PATH. 

; when d ■ BACKWARD and have path-costs, use best path of the three -- 
; else stop when find first one (since calls ordered by simplicity) 

4. If fail to find a dependency path for pinterp P(G gi S s ) 

then STATUS (.P{G g ,S M )) — INACTIVE. ; filter it 

else Record new dependency path and path-cost for P{G g ,S s ). 

Figure 3.10: Procedure FIND-DEPENDENCY-PATH 
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The rest of this section describes how DATMX searches for each of these types of relations. It 
is assumed that one is looking for a dependency path for the pinterp F(Gq, Sg) and that G& is 
the neighboring segment in question. Since the enforcement of duration constraints is detailed 
in Chapter 6, this section only hints at how they impact these searches. 

3.7.1 Finding Frontier-State, Spanning-State, and Meeting-States Paths 

A frontier pinterp automatically has a transition consistency relation with the non-existent 
neighboring segment T unless duration constraints prevent one. For example, an instantaneous 
pinterp of a non-instantaneous frontier segment must depend on some hidden-transition path 
of non-instantaneous pinterps. 

A gpanning-state relation requires that the pinterp P{Gtf t Sg) is ACTIVE. In that case, the 
spanning of state Sg over the boundary between the neighboring segments Gq and Gjy is 
consistent as long as duration constraints are also satisfied. Since this span may continue over 
a sequence of contiguous segments, the duration of that whole span is propagated, much as 
path-costs are. This accumulated duration indicates whether extending the span would exceed 
the upper-bound on the states duration. 

Finding a meeting-states relation is also simple: find some ACTIVE pinterp of Gtf whose 
state has an state transition with Sg, in the required direction. 

3.7.2 Finding Gap-filling Paths 

To efficiently find gap-filling dependency paths, another type of lookup-table is computed from 
the environment: 

Definition 3.13 (Path lookup-table) The path lookup-table indicates the (best) path of 
states that connects each pair of states in the envisionment 

Currently, DATMI’s path lookup-table is an NxN array, N being the total number of states. 
Each entry A[t, j] contains the next state in the (best) path from state Si to state Sj, as well 
as the cost of that path. The (best) path connecting Si to Sj can be found by successively 
gathering the states A[Jfe, j] of the path to Sj from the current state S± until k = j, with k = i 
initially. 

The best non-empty path of states connecting each state to itself is also represented in this 
table. They provide the best gap-filling path between the same instantaneous state of both 
neighboring segments of the gap-fill segment. 

Generating the shortcst-path lookup-table requires ©(JV 1 ) time to find the shortest path 
connecting each state pair. For each of the N states, the shortest paths to each of the other 
states can be found by breadth-first search that only has to reach each state once. If specific 
state and transition costs are available, then a least-cost-path lookup-table can be produced 
in ©{JV 3 ) time using standard graph-search algorithms (Mehlhom, 1984). As with the state 
lookup-table, the path lookup-table is generated off-line. 

An efficient gap-filling algorithm is crucial to DATMX. The interpretation of a gap-fill segment 
might be any path of states through the environment, since this segment provides no property 
constraints. Fortunately, an optimal gap-filling dependency path connecting two pinterps can 
immediately be determined by simply accessing the path lookup-table. Furthermore, whether 
some state can occur during the gap is indicated by whether there are some paths in the 
envisionment between that state and the states of ACTIVE neighboring pinterps. 


32 



Enforcing duration constraints on gap-filling dependency paths is difficult. The problem 
arises whenever the duration of the gap conflicts with the estimated duration of the gap-filling 
path. This problem could sometimes be resolved by considering part of the path to be a hidden- 
transition over G g . This would reduce the duration of the portion of the path that is over the 
gap-fill segment, 

DATMI currently does not allow gap-filling dependency paths to include hidden-transition 
paths in G v That assumption allows the ga^filling path to be indicated simply by the pinterp 
P at the other end of that path from P(G^,55), The complete path can then be quickly 
reconstructed at interpretation time from the path lookup-table. However, in a more general 
implementation where global constraints (see Section 8.3.2) might cause some pinterps of a gap- 
fill segment to become INACTIVE* the entire dependency path across a gap-fill segment would 
have to be recorded. 

3-7.3 Finding Hidden-Transition Paths 

Hidden-transition dependency paths are the most complex ones because they may consist of 
many ACTIVE pinterps from G g * Yet, unlike for gap*filling paths* a lookup-table for hidden- 
transition paths would require space exponential in the number of states. This is because the 
space of possible hidden-transition paths depends on the specific set of ACTIVE same-segment 
pinterps, as well as the specific set of ACTIVE neighboring pinterps. 

The efficiency of fin d in g hidden-transition paths is critical, since every pinterp which is going 
to be filtered must first be checked for a hidden-transition dependency path. This check requires 
searching the entire space of possible hidden-transition paths This space is exponential in 
the number of ACTIVE pinterps of Gq and Gy. 

This search starts with the pinterp P{G Gj S s ), the set A of ACTIVE pinterps of segment G g , 
and the set Ay of ACTIVE pinterps of neighboring segment Gy. A path must be found which 
connects P(G Gi Ss) to some P(Gy, 5/) in set Ay t using only pinterps in set A and transitions 
in the envisionment. 

A simple method for finding such paths is to search breadth-first from P(G Gi S s ) through 
the envisionment, while only expanding from states which have corresponding pinterps in set 
A* until some pinterp in set Ay is reached. By marking each state as it is examined, so that it 
is never examined again, this approach finds a shortest hidden-transition path. 

To find the lowest-cost path, search must continue until all promising alternative paths have 
been explored. DATMI uses best-first search which discards partial search path as soon as its 
accumulated cost exceeds the cost of the current best path. 

Unfortunately, this best-first search could require time exponential in |A| + \Ay\. However, 
simple graph algorithms can find the least-cost paths connecting ail pairs of nodes in a graph of 
N nodes in fixed-cost ©(TV 3 ) time (Mehlhom, 1984). from P(Gq* Ss) fails to terminate after 
some predetermined £?{(|Aj + |Ajv|) 3 ) number of pinterp examinations. This exhaustive graph- 
search among the pinterps in A + Ay ensures that the time complexity of hidden-transition 
path search remains within 0((lA| + |Aiv|) 3 ) while still finding the best dependency path. In 
practice, DATMI r s best-first search usually finds hidden-transition paths well before the number 
of pinterp examinations reachs the predetermined cutoff. 


^Unlewi, of course, one is willing to overlook some hidden-transit ion paths that axe unlikely or involve too 
many statu. Section 8-3-1.1 discusses the possibility of ignoring some transitions or states indefinitely. 
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Breath-first search is still performed, even when the best path is desired. This search 
provides a cheap way of checking that some hidden-transition path exists, before looking for 
the optimal one. 

3*7.4 Improving Hidden-Transit ion Search 

OiTMI actually uses an improved version of the hidden-transition path-finding algorithm de¬ 
scribed above. For example, it removes every pinterp from set A which is also in set Ajv- Once 
search reaches a state of an ACTIVE pinterp of the neighboring segment, that path always has 
less cost than any extensions. 

Additional pinterpe are removed from A if they cannot possibly belong to any acyclic hidden- 
transition path. Some of these useless pinterpe can be identified by noting that the length of an 
acyclic path cannot be more than the number of pinterpe from which to choose. So, a pinterp 
P{Gq , Si) is removed from A whenever either: 

1 . The length of the path for shortest-path lookups table (5,*] > |A|. 

2. The length of each path for shortest-path lookup-table[i j] > j A\ for all P(Gjv, S ; ) in Ajv* 

In the first case, F(Gg,S*) is removed because there simply are not enough pinterpe in A to 
provide a hidden-transition path from P(GQ f S$) which goes through P(Go,Si ). Likewise, 
pinterps are removed from Ajv which have a known shortest path from P[Gg,$s) which is 
longer than \A\ + I. 

Additional techniques provide more efficient expansion from the current state being consid¬ 
ered in the breadth-first search. During expansion, one must determine which pinterps in A or 
As correspond to states that are directly connected (via a state transition of the appropriate 
direction} to the current state in the envisionment. A contender e-liet represents which pinterps 
of A and As have not yet been explored during expansions. As search progresses, pinterps are 
removed from this contenders-list. 

So, one could expand from the current search state by determining either: 

1 . which states in the envisionment that are directly connected to the current state also 
correspond to pinterps of A or Ajv, or 

2 . which pinterps in the contenders-list are directly connected to the current state. 

Option 1 requires time proportional to the number of states directly connected to the current 
state. To achieve that time complexity, the states of the envisionment are tagged at the start 
of the hidden-transition search with the pinterps of A or As to which they correspond. By 
checking such tags, the determination of whether a state corresponds to a pinterp of A or 
An takes constant time. Alternatively, option 2 can be performed in time proportional to the 
number of pinterps in the contenders list. This is because whether a pinterp directly connects to 
the current state can be determined in constant time by referring to the shortest-path lookup- 
table. 

Thus, the selection of an expansion method depends on the relation between the sizes of the 
contenders-list and the set of state transitions for the current state. If the number of remaining 
contenders is smaller than the number of states directly connected to the current state, DATMI 
uses option 2. Such an approach ensures that the hidden-transition search gets quicker as 
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more and more pinterps are eliminated from the list of contenders. At the same time, it takes 
advantage of cases where a state has few transitions. 

Unfortunately, the hidden-transition path-finding algorithms described above are slightly 
incomplete because they would not find a dependency path with an instantaneous state occur¬ 
ring between two meeting segments. In theory, an instantaneous behavior, such as the collision 
of a ball with a wall, might not be captured with the given observations due to insufficient 
temporal resolution. This problem does not arise in practice because DATMI interprets numeri¬ 
cal measurements with conservative translations into qualitative properties. Such translations 
always blur property value changes over some non-instantaneous period of time. Thus, the 
DATMI implementation does not worry about this case. 

If conservative translations were not possible or desirable, this problem could be solved in a 
couple of ways. For one, a gap-fill segment of instantaneous time duration could be used between 
every pair of non-gap-fill segments. Gap-filling search would then try to find an instantaneous 
state lor that gap-fill if some state cannot be found which spans between Gq to the other 
neighbor of the gap-fill segment. However, maintaining a history where every other segment is 
an instantaneous gap-fill segment would be cumbersome and expensive. 

Alternatively, the basic hidden-transition algorithm could attempt to extend a working 
hidden-transition path which fails to reach any ACTIVE pinterp of the neighboring segment 
using only ACTIVE pinterps of Gq. The working path would be extended by some instantaneous 
states which need not be compatible with any segment properties for Gq - If the extended path 
can then reach an ACTIVE pinterp of the neighboring segment, that path would be a valid 
dependency path. 
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Chapter 4 

ADJUSTING THE 
PINTERP-SPACE TO HANDLE 
FAULTY DATA 


Sometimes the system model can offer no interpretation of the observations. As noted in 
Chapter 3, this is heralded by an in consist ent segment,, a segment without ACTIVE pinterps. 
General strategies for handling an inconsistent segment include: 

• Giving-up: Ignore the inconsistency and continue to interpret the other segments. 

m Changing-properties: Activate pinterps by changing some segment properties, to re¬ 
flect doubt in the original observations. 

• Model-refinement: Change the physical model, to provide an alternative envisionment 
which provides ACTIVE pinterps. 

• Recruiting-unknowns: Try activating pinterps with UNKNOWN status. 

• Incremental Envisioning: Enhance a partial envisionment with additional states or 
transitions which yield new ACTIVE pinterps. 

DATMX currently uses only the giving-up and changing-properties strategies, using the fol¬ 
lowing three-step process: 

1. Determine a set of changes in segment properties which might fix the inconsistent segment. 

2. Apply the effects of those changes to the entire pinterp-space. 

3. If inconsistency remains, retract aU changes and then either retry step 1 or give up. 

Giving-up is a last resort, for when no changes in the observations or model can be made 
within resource limits. The interpretation construction and filtering algorithms ignore an in¬ 
consistent segment. So, inconsistent segments partition the history into sub-histories that are 
separately interpreted and maintained. Whenever an inconsistent segment is fixed, the two 
neighboring partitions are merged into one. One could, therefore, postpone the handling of an 
inconsistent segment until sufficient computational resources are available. 
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Deteimimng what segment property changes to try is difficult. In the worst case, accurate 
credit-assignment requires exponential search. How DATMI handles this problem is explained in 
Section 1.2. Algorithms for efficiently adjusting the pinter^&pace to reflect property changes 
are then described in Section 1.3. 

It should be noted that these strategies may be desirable even when no segment is actually 
inconsistent. For example, if the path-coat* for all the ACTIVE pinterps of some segment are too 
high, then better pinterpa for that segment might be requested. Such new pinterps might be 
provided by recruiting-unknowns, incremental envisioning, or model-refinement strategies. The 
effects of these new pinterpa could be determined by using techniques similar to ones currently 
used by DATMI to propagate the effects of changing properties. 

4.1 Faulty Data 

How do inconsistencies arise? Some result from faulty models which give envisionments that 
are missing possible state* or transitions. The other source of inconsistencies is faulty data . 
Faulty data can arise in three ways: 

• true noise: random deviations in the sensor signal (such as white noise). 

• conversion failure: an incorrect translation of the analog signal into qualitative values. 

• sensor failure: the sensor is operating abnormally. 

When numerical data are translated into conservative qualitative properties (as discussed 
in Chapter 2), true noise rarely results in property assertions that disagree qualitatively from 
the actual behavior. Smoothing sensor signals using traditional engineering techniques, such as 
Gaussian convolution, typically suffices to capture overall trends. 

Unfortunately, such smoothing can sometimes hide qualitative changes which are actually 
occurring. One might try to first interpret the imsmoothed data and then try interpreting 
smoothed data if inconsistencies arise. Thus, a type of conversion failure would be detected 
which might be fixed by changing the segment properties to reflect the smoothed data. However, 
complex control issues, such as how to efficiently find the right grain-size (perhaps by successive 
smoothings at different levels), must then be addressed. Because of such difficulties, DATMI does 
not try such fixes. 

Conversion and sensor failures always require adjusting the segment properties to recover 
from misleading data, since they cannot be prevented by initial preprocessing. Conversion 
failure occurs when the data sampling rate is too slow to capture every relevant qualitative 
change. Properties measured as constant, using a suspiciously slow sampling rate, would be 
candidate sources of inconsistency. Sensor failure occurs when the sensor breaks and produces 
misleading information. 


4.2 Generating Possible Fixes to the Pinterp-Space 

Fixing a pmterp-epace with an inconsistent segment involves first determining which obser¬ 
vations to doubt. Within the DATMI framework, this involves postulating which properties of 
which segments might have caused a segment G/ to have no ACTIVE pinterps. A candidate set 
of dubious observations is indicated by a fix-hypothesis: 
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Definition 4.1 ( F bc-hypo thesis) A fix-hypothesis consists of a set of doubted properties pj 
for each corresponding segment Gy € G, where G is the set of alt segments with doubted prop¬ 
erties. 

Several issues complicate the search for plausble fix-hypotheses: 

m Fracturing - one fault can misrepresent the same system variable over many contiguous 
segments. 

e Hidden faults - the fault may have started before any inconsistency actually arose. 

• Multiple faults - different faults might each cause different segment properties to be in¬ 
correct- 

Fracturing is caused by the splitting of property assertions during global segmentation. 
Because of this fracturing, it is not always sufficient to change some properties of just one 
segment. Furthermore, an inconsistent segment need not have any incorrect properties itself, 
since faulty data globally affect the pinterp-space. Consider some other segment G# to have 
incorrect properties, instead of the inconsistent segment G/. Even if Gj has some COMPATIBLE 
pinterps, all of its pinterps will be INACTIVE whenever some INCOMPATIBLE pinterps of Gs must 
be ACTIVE for some of G/’s pinterps to have dependency paths. 

While the current implementation of DATMI handles only sensor failures, the DATMX frame¬ 
work suffices for both sensor failures and conversion failures. For either class of failure, DATMI 
only generates candidate fix-hypotheses which suggest forgetting some segment properties. This 
reflects strong uncertainty about what is really happening to the system variables of those prop¬ 
erties. Such forgetting is conservative because it never leads to any ACTIVE pinterps becoming 
INACTIVE or INCOMPATIBLE. In contrast, changing the values of some properties would introduce 
another source of faulty data to worry about - the fix-hypotheses themselves. 

So, DATMI generates candidate fix-hypo theses each consisting of a set G of segments, where 
each segment G» € G has some properties pi to be forgotten. Trying all 2 A fix-hypotheses, 
where A is the total number of property assertions over all segments, is intractable. So, DATMI 
focuses generation using domain-specific knowledge about: 

1 . The plausibility of doubting each segment property. 

2 . The condition* under which each fix-hypothesis is applicable. 

A fix-hypothesis must be retracted whenever its conditions are violated while processing later 
observations. 

The next two sections discuss the generation of fix-hypotheses for recovering from sensor 
failures and conversion failures. Section 1.4 suggests ways to improve DATMI ’a generation of 
fix* hypotheses. 

4.2*1 Sensor Failure Fbc-Hypotheses 

A sensor failure fix-hypothesis suggests some sequence of segments over which a property was 
incorrectly indicated by a failed sensor. For example, consider an indicator light which is 
suppose to be ON when a pump is pumping and OFF when is not. A sensor failure occurs when 
that tight burns out and is OFF even though the pump is actually pumping. So, if the light is 
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Figure 4,1: Example of a sensor failure fix-hypothesis 
This hypothesis H represents doubt that properties of name X has value OFF from G$ to G^* 


OFF amid there is an inconsistent segment, DATMI will generate a fix-hypothesis that the indicator 
has failed, 

A simple sensor failure fix-hypothesis H postulates that some properties, ail of some name 
X y are incorrect. Figure 1.1 gives an example of a sensor failure hypothesis for properties of 
name X . Let v be the value of a property of name X for the latest segment G i that asserts 
any value for X. Also, let segment G& be the earliest segment that asserts v for X without 
any segment G* where Gp G* and G& asserts X to be something other than v. Then, set 
G for hypothesis H will consist of all segments from G £ through Gi which assert a value for 
X % namely value v * For each Gi € G, pi is just the singleton set of the property with value v 
and name X . One must doubt as far back as Ge to allow for the possibility that there was a 
hidden fault for X anywhere from Gg to Gl* 

The key condition for the fix-hypothesis B is that later observations do oot assert a value 
/ of X for some future segment Gp (i.e* G£ ^ Gp) t such that / differs from the value v of X 
during G^. This condition reflects the two simplifying assumptions for sensor failures used by 
DATMI; 

1 . A failed sensor produces qualitatively identical values once it fails, regardless of the true 
behavior, 

2* DATMI will be told when and if a sensor is fixed* 

When DATMI is told that a sensor has been fixed at time £, this condition is relaxed* The 
hypothesis will then not be retracted whenever values other than v are observed after £* These 
two assumptions mean that DATMI considers only non-intermittent sensor failures* Because of 
these assumptions, DATMI does not attempt to recover from sensor failures that are harder to 
detect, such as spikes in the data (e*g* an Indicator light momentarily disconnected from its 
power supply due to some vibrations). 

Many types of sensor failures do satisfy these assumptions. As previously mentioned, an 
indicator might stay in the OFF position permanently if it breaks. Similarly, a CHANGE property 
would always get a value of STEADY if the sensor is jammed* Also, an ORDER property can get 
faulty values when one of the sensors becomes uncalibrated* However, due to assumption 1 
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Above, DATMI only handles miscalibrationa that are great enough to always produce the same 
qualitative value of GREATER or LESS. This is actually desirable, since otherwise a miscalibration 
hypothesis would never be retracted. 

As these examples suggest, a sensor failure satisfying assumption 1 often results in only 
some particular subset of possible property values. So, a fix-hypothesis B is only generated 
when the value v for a property named X could result from that sensor failure. DATMI considers 
the plausibility of doubting the properties in H to be the a priori probability that the constant 
value v for X is due to the sensors of X failing. Such a priori probabilities are either supplied 
by external, domain-specific means or assumed to be equal for all values. 

DATMI also currently assumes that each sensor contributes to only one type of property. If 
a single sensor provides the values for properties of several different names (such as a CHANGE 
property as well as part of an ORDER property), then the observed values for all these proper¬ 
ties would need to be examined. If recent properties of each name indicated a sensor failure 
hypothesis for that sensor, then a fix-hypothesis for forgetting some properties of each name 
should be generated and tested just like a simple fix-hypothesis. 

4.2*2 Conversion Failure Fix-Hypotheses 

A conversion failure hypothesis identifies some segment properties that might be incorrect due 
to errors in the conversion of numerical measurements into qualitative properties. Although the 
DATMI implementation considers only sensor failure hypotheses, this section suggests a natural 
means for also handling conversion failures in this framework. 

As discussed in Section 2.3, DATMI assumes that conversion failures never occur for a property 
p while the sample time ST {p} for p is less than MIN-ST(/>), Let the value of ST(^) be the 
maximum of the sample times of all the measurements for a property p for a particular segment. 
By using a simple formula for each segment property p t such as: 

plausibility-oi-doubting (p) = (ST( p) - MIN-ST(p)) * sensor-imreliabilityCp), 

one could easily determine a reasonable ordering for doubting segment properties due to pos¬ 
sible conversion failures. The unreliability in the sensors for p might be the maximum of the 
unreliabilities for ail the measurements merged into p. 

An ordered list of the K (for some predefined K) segment properties with the highest 
plausibility of doubt could be incrementally maintained during segment merges to allow efficient 
selection of which segment property to doubt next. A simple hypothesis generation technique 
would be to temporarily forget these properties in order of plausibility until the pinterp-space is 
fixed. Then, try to re-assert each forgotten property to reduce the number of properties actually 
forgotten. These re-assertions would proceed with the least dubious properties first. This 
technique would recover even from multiple conversion failures, assuming K is large enough. 

A disadvantage of this technique is that the locality of faults is ignored. All segment 
properties with large ST(p) will be doubted before any properties with almost as large an 
Slip) which are in segments that happen to be temporally much closer to the inconsistent 
segment Gj. In practice, properties of segments much closer to G/ are more likely to constrain 
it- Thus, those closer segment properties are more likely to contribute to the inconsistency. An 
interleaved scheme where some number of closest properties are also forgotten in order of their 
measure of doubt is required to enforce some locality. 

The key conditions for a conversion failure fix-hypothesis are the values of MIN-ST(p) for 
each segment property p it forgets. If MXN-ST(p) drastically lowers, then the relative doubt 
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of p compared to other segment properties may also drop drastically. Automated methods 
for determining MIN-ST(p) and MAX-ST(p) for the observed properties might make such drastic 
changes. If the affected segment properties are now more dubious than the forgotten segment 
properties, these highly dubious ones should be forgotten. Then an attempt to re-establish 
those previously forgotten properties, in reverse order of doubt, should be made. 


4.3 Applying a Fix-Hypothesis To the Pinterp-Space 

Given a fix-hypothesis, DATMI propagates its effects and determines if the pinterp-space becomes 
consistent. If the pinterp-space remains inconsistent, then the effects of this hypothesis are 
retracted. Alternative hypotheses are likewise tested until the pinterp-space is fixed. If the set 
of hypotheses is exhausted, DATMI gives up and accepts the inconsistency. Since DATMI uses fix- 
hypotheses which only forget properties, this propagation process cannot result in any ACTIVE 
pinterps becoming INACTIVE. 

Figure 1.2 presents the algorithm for adjusting the pinterp-space based on a fix-hypothesis 
which forgets some segment properties. First, those properties are removed from their segments. 
Next, all pinterps which change from INCOMPATIBLE to COMPATIBLE, due to the reduced property 
constraints, are considered INACTIVE. Finally, the procedure PROP AGATE-NEW “PINTERPS (as 
shown in Figure 1.3) is used to activate all pinterps which newly satisfy the transition constraints 
because of these newly COMPATIBLE pinterps. 

Lower-cost dependency paths can become available when pinterps are newly activated. Step 
2f of procedure PROP AGATE-NEW-PINTERPS ensures that such better dependency paths are found. 
Step 2f allows 9tep 2h to propagate path-cost decreases forward from current segment G t , 
by updating the path-costs of pinterps in G, to reflect the changes caused by the backward 
propagation of step 2c. 

The ability to propagate activations of pinterps allows DATMI to easily batch process obser¬ 
vations for several segments at once. The ability to interleave batch and incremental processing 
of observations could support more flexible real-time reasoning. Figure 1.4 gives an algorithm 

for such batch processing. This algorithm uses PROP AGATE-NEW-PINTERPS to find dependency 

v 

paths for pinterps of segments having their initial properties asserted while using procedure 
REFINE-PINTERPS (recall Figure 3.5) to propagate the effects of asserting additional properties 
for segments. Step 6 propagates the effects of asserting initial properties for segments, by first 
seeking initial transition consistency relations between those segments and the pinterps of the 
neighboring segments. 

The process of propagating activation is detailed in Figure 1.5. Each propagation sweep 
proceeds until either: (a) no reactivations occur for some segment or (b) a frontier segment is 
updated. These sweeps first allow INACTIVE pinterps to be part of dependency paths (in step 
5), in case some of the newly activated pinterps can activate those pinterps as well. Then, they 
check (m step 7) whether all the pinterps of such a path have become ACTIVE. If they are not, 
the PROPAGATE-FILTERING-EFFECTS of Figure 3.6 is invoked. 

Of special interest in this procedure is the need to invoke the propagation of path-costs from 
the seed-segment G g to its t -neighbor when propagating activation forward, as noted in step 
3. Such a propagation is necessary because some ACTIVE pinterps of the f-neighboring segment 
might have a lower-cost alternative b-dependency path using the enhanced pinterps of G ? . Tne 
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Given: fix-hypothesis H for inconsistent segment G j. 

H suggests forgetting properties p; for each corresponding segment G{ of list G. 
(G is ordered from left-most to right-most segments). 


1. For Gi € G do 

a_ SEG~PROPS(G<) «- SEG-PROPS(G*) - ft. 
b. If SEG^PROFS(G t 0 0 
then 

i. Mark G t as gap-fill segment, 
ii. Merge Gi with any neighboring gap-fill segments, 
else 

For Sj € COMPATIBLE-STATES(SEG-PROPStG,-)) do 
If STATUS (P{G if Sj)) m INCOMPATIBLE 
then STATUS(F(G|, Sj)) INACTIVE. 

2. Call PROPAGATE-NEW-PINTERFS(G), 

Figure 4.2: Procedure TET-FORGETTING-FII-HYPOTHESIS 


set of enhanced pinterps consists of the newly reactivated pinterps of G g and any pinterps of 
G 9 which have had their own path-costs lowered, 

4-3.1 Propagating Path-Cost Decreases 

Figure 1,6 gives the procedure INSTALL-LOWEtt-COST-DEPENDENCIES to minimise path-costs af¬ 
ter propagating activations backwards. Forward propagation of activation automatically prop¬ 
agates the effects of path-coat decreases. This is because the path-costs of all the pinterps 
of the b-neighboring segment already had their path-costs updated when b-dependency paths 
were sought for them. However, after backward propagation of activation, some pinterps in the 
seed-segment may have lower-cost chains of b-dependency paths back to some pinterps in the 
stop-segment, because newly activated pinterps were not considered. So, the path-costs of the 
pinterps in the stop-segment must be propagated forward, all the way to the pinterps of the 
seed-segment. 

The main idea is to sweep forward from the stop-segment (INSTALL-LOWER-COST-DEPENDENCIES^s 
start-segment) to the seed-segment (finish-segment) until no more improvements in the path- 
costs can be made. During this sweep, few of the ACTIVE pinterps of the f-neighboring segment 
actually look for better b-dependency paths. Let c be the path-cost of a pinterp P(G gi S a ), 
minus the cost of the transition to it in its b-dependency path and the cost of S a , Also, let l be 
the lowest of the path-costs of the enhanced b-neighboring pinterps. P(G^,5 4 ) needs to see if 
it has a better b-dependency path only if c is higher than /, That is, if the path-cost is already 
at least as low as the best conceivable lowest-cost b-dependency path would allow, then there 
is no need to search for a better one. 

Note that the forward sweep of INSTALL-LOWER-COST-DEPENDENCIES stops as soon as one 
of the following occur: (a) the given finish-segment is reached or (b) no more reductions in 
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Given: list G of segments G,-, where G ordered from left-moat to right-most segments. 


1 - Fox' Gi € G do 

When GAP-FILL-SEGMENT?(GJ 

a. Replace G,- in list G by its b-neighbor. 

; or the 1-neighbor if the backward one does not exist. 

b. For d G {BACKWARD .FORWARD} do 

G„«- NEIGHBOR-SEGMENT(Gi.d). 

For P€ ACTIVES(G„) do 

i. STATUS(jP) — INACTIVE, 

ii. Remove P from ACTIVES(G n ) . 

iii. Add P to INACTIVES(G„). ; will reactivate in step 2 

2. For each Gi, in the given order of G do 

a. ACTIVES (Gf). 

b. Assume that each INACTIVE pinterp of G,* is ACTIVE. 

c. Call PROPAGATE-PINTERP-ACTIVATIQN(G t -,BACKWARD) . 

d. G, «- PROPAGATE-PINTERP-ACTIVATION’S stop-segment G z - 
e A*— PROPAGATE-PINTERP-ACTIVATION’a reactives R z . 

f. Call INSTALL-LOWER-COST-DEPENDENCIES(G,.G,-.A). 

g. E «— ACTIVES (Gi) — Af, . ; remaining reactives , 

h. Call PROP AGATE-PINTERP-ACTIVATION^. FORWARD, E). 

i- G, ♦- PROPAGATE-PINTERP-ACTIVATION’s stop-segment G z . 
j. For G g e G do If G, ^ G, then G «- G - G g . 

\ all consequences of G a have already been propagated 
; when activation propagation passes up that segments 


Figure 4.3: Procedure PROPAGATE-NEW-PINTERPS 
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Given: new properties pi for each updated segment Gi of list G, where G is ordered from left¬ 
most segments to right-most segments. 


1. I*— 0, ; segments with initial properties 

2. U '0. ; updated segments 

3. For each segment G, of G in order of G do 

a. If pi are the initial properties for Gi, then 

i. C - COMPATIBLE-PINTERPS(*,Gi) 
ii. INACTIVES(Gi}+- C. 
ill. Enqueue segment G, onto qneue /. 

b. Else, Enqueue Gi onto queue U. 

4. Call PROPAGATE-NEW-PINTERPS(7). 

5. For Gi € U do Call REFINE-PINTERPS(G tl p,-) . 

6 For each segment Gi of 7 in given order of / do 
For d€ {BACKWARD,FORWARD} do 

a. G n «- NON-GAP-FILL-NEIGHBOR (Gi.d). 

b. F*~9. ; filtered pinterps 

c ■ Unless G n £ G 

i. For P(G n ,5»)e ACTIVESCGJ do 

Call FIND-DEPENDENCY-PATHCP(G„, 5,) .REV-DIR(d) ) . 
If fail then F *- FuP(G„,S,). 
ii. Call PROPAGATE-FILTERING-EFFECTS(G n .P). 


Figure 4.4: Procedure BATCH-UFDATE-PINTERP-SPACE 
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Given: seed-segment G g and propagation direction d. 

Also given set E of enhanced pinterpa if propagating in forward direction. 
The inconsistent segment G/ and current fix-hypothesis H are also known. 
Returns: stop-segment G z and its reactivated pinterps R Z - 


1. R z <-9. 

2. G n *~ NaN-GAP-FILL-NEIGHBOR(G g ,d) . 

3. When d — FORWARD 

a. Call INSTALL-L0WER-CaST-DEPENDENCIES(G,,G,.J5) . 

b, B *- INSTALL-LOWER-COST-DEPENDENCIES’s enhanced pinterps L. 

4. f?*-0, ; reactivated pinterps 

5. For P{G n> S,)€ INACTIVES(G n ) do 

a. Call FIND-DEPENDENCT-PATHCP(G„,S,).d). allowing 

INACTIVE pinterps of G n to be used in hidden-transition paths. 

; All dependencies for newly activated pinterps will be confirmed 
; later when G n becomes G g during the propagation. 

b. If succeed, then 

i. STATUSCP(G„,5,)) «- ACTIVE, 
ii. R «- R U P(G„, 5,). 

6. U «— 0. ; unconfirmed pinterps 

7 . For F(G„,S,} e R do 

When some P(G n ,Si)e DEPENDENCIES(P(G„, 5.) .d) 
such that INACTIVE?(P(G,„ Si)) 

a. Call FIND-DEPENDENCY-PATH (P(G„,S a ).d). 

this time not allowing INACTIVE pinterps (unlike step 5a). 

b. If fail then R *— R - P{G n , S ,). U *- U\JP{G nr S n ). ■ 

8. Call PROP AGATE-FILTERING-EFFECTS <G n . 17. d). 

; Updates pinterps depending on any unconfirmed pinterps of U. 

If an inconsistent segment G is detected during this propagation, 
then Call RETRACT-FIX-HYPOTHESIS(if ,G) . 

9. If R = 0 then G z G a 

else 

R Z - R. 

If FRONTIER - SEGMENT? (G n ) then G z *-G n 
else 

Gg * G n . 

If d- FORWARD then E^-BkjR. 

Goto step 2. 

Figure 4.5: Procedure PROPAGATE-PINTERP-ACTIVATION 
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Given; start-segment G t7 finish-segment G/, and set of enhanced pinterps E of G $r 
Returns: final enhanced pinterps L. 


1. G n <— NQN-GAP-FILL-NEIGHBOR (G # , FORWARD) . 

2. If G n = 0 then exit. 

3. (7 lowest path-cost of all pinterps in £. 

4. L $ ; pinterps with lowered path-costa 

6. For P{G n ,Si)€ ACTIVES (G») do 

When PATH-COST (P(G m 5,-)) >C 

; not counting itself and the immediate transition from it 
a Z+- PATH-COSTCP(G mj S0)* 

b. call FIND-DEPENDENCY-PATH (F(G m Si) * BACKWARD) . 

c. If path-cost of PfG*^) is now lower than Z 

then F(G n ,5 t ). 

6. Unless L — 0 or G, — Gy 

£. 

Goto step 1, 


Figure 4-6: Procedure INSTALL-LOWER-COST-DEPENDENCIES 


path-costs can be made. This finish-segment is typically the seed-segment of the sweeps for 
propagating activation. As mentioned above, stopping at the seed-segment is sufficient since 
forward propagation of activation automatically propagates path-cost decreases. 

It is not sufficient to only propagate path-cost decreases along the existing dependency 
paths. For example* let F(G n ,£,) be the b-neighboring pinterp of the current b-dependency 
path for a pinterp P. If some other neighboring pinterp F(G n ,S r ) gets a reduced path-cost 
and could allow a better b-dependency path for F, then P should use the b-dependency path 
containing F(G n ,5 r ) instead. However, having P(G nj S r ) only tell the pinterps that b-depend 
on it that its cost was reduced would fail to update F. Therefore, one must instead look at all 
the ACTIVE pinterps of a segment, to see which ones might benefit from any reduced path-costs 
of the b-neigh boring pinterps. 

4,3-2 Retracting a Fix-Hypothesis 

When applying a fix-hypothesis does not fix an inconsistent segment, DATMI retracts that fix- 
hypothesis. Figure 1.7 outlines this retraction process* This same procedure is used when 
future observations indicate that a fix-hypo thesis that had been applied successfully violates 
the conditions of that fix-hypothesis. Retracting a fix-hypothesis will again result in some 
inconsistent segment, unless sufficient other relaxations to the constraints on the pinterp-space 
have occurred since it was first applied* 
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Given: fix-hypothesis H for inconsistent segment Gj. 

S suggests forgetting properties pi for each corresponding segment G* of list G s which is ordered 
from left-most to right-most segments. 


1. For each segment G t i in order of G, do 

; recover the properties forgotten for fix-hypothesis H 
Call REFINE-PINTERPStG,.*). 

2, If no pinterps are ACTIVE for some segment Gb* during 

any propagation sweep used by REFINE-FINTERPS in step 1, then 
; detected inconsistent segment G B ! 

a. If currently fixing the pinterp-space* then 

i. If G b # Gr 

then Add G$ to Iq- 

; Where Iq is the global set of 
; inconsistent segments detected since the first 
; inconsistent segment was detected, for the 
; current observations. 

else ignore inconsistency ; it p s being worked on ... 

ii. Return to the caller (PROPAGATE-PINTERP-ACTIVATION), 
performing step iii below afterwards (by which 
time the global Iq may have changed): 

iii. For G € Iq do 

When ACTIVES(G) » 0 

;: G didn * t happen to get f ixed when G j was. 

Try to fix G ; like in step 2b. below 
; Tries to fix an inconsistent segment that was not 
; originally handled because PROPAGATE-FILTERING-EFFECTS 
; stops at the first inconsistent segment it sees. 

b. Otherwise; 

; fix-hypothesis S previously worked but now needs to be retracted 
Handle Gb like any other inconsistent segment, using 
TRY-FORGETTING-FIX-HYPOTHESIS to test possible alternative 
fix-hypotheses. 

Figure 4.7: Procedure RETRACT-FIX-HYPOTHESIS 
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4.4 Improving Fix-Hypothesis Generation 

Additional heuristics and domain-specific knowledge could further guide DATMX’s ordered gen¬ 
eration of fix-hypotheses. Because the search space of possible fixes is so large, strong focus is 
necessary to allow more robust handling of faulty data. This section considers three especially 
desirable measures of a fix-hypothesis H that could help improve DATMI’s current performance: 

• fix-cost {Cm) - cost of updating the pinterp-space, 

• fix-hope (J/jr) - likelihood that H will work, and 

• fix-utility (Ziff) - overall desirability of 3. 

Of course, to be useful, fix-cost and fix-hope must be estimated before actually applying the 
fix to the pinterp-space. However, fix-utility might first be roughly estimated to provide initial 
priority and then be adjusted once the fix is applied. 

4.4.0.1 Estimating Fix-Cost Ca 

The fix-cost Ca estimates the number of changes in the pinterp dependencies required to apply 
H. Since a change in a pinterp J s dependencies might propagate into changes in any other pin- 
terp’s dependencies, the fix-cost is extremely difficult to determine accurately without actually 
propagating the changes. Yet, one would at least like to first try fixes requiring almost no 
changes in the pinterp-space before trying fixes that would require many changes. 

One simple good heuristic is that the fix-cost is likely to be proportional to the number of 
pinterps which become COMPATIBLE when properties are forgotten. The fix-cost is likely to be 
further increased when these pinterps are more equally distributed among all segments, since 
each of those changes are most likely to affect the segments closest to them. Since in practice 
only a small fraction of the COMPATIBLE pinterps tend to be ACTIVE as well, these heuristics 
tend to overestimate the fix-costs; these overestimations provide upper bounds on the fix-costs 
that are useful for real-time processing. 

4.4.0.2 Estimating Fix-Hope Ha 

For B to succeed, its adjustment must make some pinterp become ACTIVE for the inconsistent 
segment Gj. A measure for fix-hope should reflect the notion that more property changes in 
the vicinity of Gj increase the hkslihood that the inconsistency will be removed. Thus, a simple 
estimate of the fix-hope Ha would be one proportional to the estimate for fix-cost given above. 

Inconsistency often arises when none of the pinterps for Gj are even COMPATIBLE. For 
example, consider the pump-cycle of Figure A.l. No state will be compatible with properties 
asserting that the water levels of both containers are increasing at the same time. Forgetting a 
property for a segment other than Gj will not resolve the inconsistency - at least one property 
over Gf itself must be forgotten. However, even this is not enough to resolve the inconsistency 
in general. Thus, the fix-hope in these cases should be zero unless H allows some pinterps of 
Gf itself to become COMPATIBLE. 
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4.4.0.3 Estimating Fix-Utility Us 

The fix-utility measure Us for a fix-hypothesis S can be based on two main factors: domain- 
specific knowledge about the sensors and task-specific preferences on the alternative consistent 
interpretations. Domain-specific sensor knowledge can influence the initial estimate of fix-utility. 
For example, each fix-hypothesis’s plausibility measure estimates how a priori likely it is that 
the data removed by the fix are actually faulty. Once the inconsistency is fixed, the fix-utility 
might be adjusted to reflect the path-coet or path-probability for the best global interpretation 
in the resulting pinterp-space. 

4.4.0.4 Discussion of Fix-Hypothesis Generation 

The availability of these three measures would allow generation to focus resources on the best 
trade-offs between expected time of adjustment and quality of interpretations. Real-time pro¬ 
cessing would typically demand that adjustment costs are small whereas an analysis of long-term 
behavior might favor interpretations that maximize interpretation credibility in light of possible 
faults. An overall score for each hypothesis could be based on a task-dependent weighted sum 
of these Cs* Hr, and Us factors to determine which hypothesis to try next. Search for the 
fix which maximizes the Us could proceed until time limitations were reached. The overall 
score should also depend on how much processing time remains. For example, for real-time 
reasoning, one might first ensure that some working fix is available and then use the remaining 
time to find one having much higher fix-utility. 

Fix-hypothesis generation should also consider multiple faults. Inconsistencies due to mul¬ 
tiple faults might involve both sensor failures and conversion failures. The method for handling 
multiple conversion failures suggested in Section 1.2.2 - ordered forgetting of segment prop¬ 
erties until the inconsistency is removed and then re-asserting as many of them as possible 
- could also handle multiple faults in general. However, that approach could easily result in 
compounds fixes which forgot too many different types of properties when each hypothesis sug¬ 
gested forgetting only a couple of segment properties. To help ensure that properties of only a 
few different names are doubted, one could prefer fix-hypotheses that forget segment properties 
having the same names as properties already forgotten for other segments by previously applied 
fix-hypotheses. 
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Chapter 5 


MAINTAINING 

INTERPRETATION 

CREDIBILITIES 


The algorithms discussed so far have focused on maintaining the space of consistent interpre¬ 
tations. Being aware of these alternative interpretations is essential to conservative monitoring 
and to handling faulty data. However, to accurately predict the future behavior of the sys¬ 
tem, one must determine its most likely current state. Similarly, to explain or summarize 
observations, one may want the most Likely or simplest global interpretation. 

DATMI provides a means for determining these best interpretations. It uses a generalized 
notion of the path-coats introduced in Section 3,5, as follows: 

Definition 5.1 {Interpretation credibility) A pinterp f s path-credibility is the real-valued 
measure of the probability or inverse cost of the chain of b-dependency paths leading to it. An 
interpretation credibility is the path-credibility of the final pinterp in that global interpretation. 

Path-credibilities are maintained using the same algorithms as for path-costs, although they 
are composed either additively or multiplicatively, as appropriate. 

For example, the use of path-costs in Section 3,5 employs additive composition. To provide 
a basic measure of the simplicity of an interpretation, one could use 1 as the cost of each 
transition and 0 as the cost of each state. Alternatively, to better detect behaviors which could 
lead to dangerous states {like those where a factory explodes), one could give the lowest costs 
to all states that have paths to those dangerous states. 

The rest of this chapter describes how DATMI provides a probabilistic measure of interpre¬ 
tation, credibility by using multiplicative composition of Bayesian conditional probabilities. In 
this case, each path-credibility is referred to as a: path-probability: 

Definition 5.2 (Path-probability) A pinterp’s path-probability is the probability that the 
the chain of b-dependency paths reaching that pinterp represents the actual behavior. 

5.1 Determining Path-Probabilities 

As described below, each path-probability is locally composed from two sources: 
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Figure 5*1: Example of a probabilistic envisionment 

Each transition is labelled with its conditional probability while each state is labelled with its 
a priori probability (in parentheses). State 5? is an instantaneous state. 


• state and transition probabilities (model-based) and 

• property probabilities (observation-based). 

5*1*1 Using State and Transition Probabilities 

For a given domain, there are often common sense or empirical notions of the relative likelihoods 
that various states or transitions occur. For example, one might know from experience that 
when a system is in a particular state, it almost always proceeds to a certain other state next. 
To represent such knowledge, DATMI can use: 

Definition 5,3 (State and transition probabilities) The state probability of state S 3 is 
the a priori probability Prob(S M ) of being in S s at the start of the observations . The transition 
probability of a transition S t —► Sf from some state S 9 to another state Sf is the conditional 

probability Prob(Sf \ S 9 ) (also denoted as Prob(S 3 Sf)) of being in Sf as soon as S 3 ends , 

# 

Figure 5.1 provides an example envisionment which is augmented with state and transition 
probabilities, 

Prob(S t —► S 3 ) is the probability that a system stays in state S 3 from one segment to another. 
To strictly adhere to probability theory, a particular transition probability Prob(S s —► Sf) 
should only indicate the probability of S t —+ 5/ occurring at one particular time. DATMI 
assumes that it is acceptable to use the same value of Prob[S 3 —* S/) no matter what time 
S$ —► Sf occurs or how long S 3 had lasted before this transition. Motivations and consequences 
of this assumption are discussed in Section 5.1,3. Typically, this simplification is sufficient 
for at least finding one of the more likely interpretations. 

DATMI assumes that some domain-specific sources provide these state and transition proba¬ 
bilities, For example, they might be obtained by stochastic analysis techniques, such as those 
developed in (Doyle it Sacks, 1989). In any case, the following conditions will hold for any 
complete and consistent envisionment of N states: 

1. £,=i Prob(Si) = 1. 

2. Prob(S, —<■ Sf) = 0 whenever there no transition 5, —+ Sf. 
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3. Prob(S, -* Si) = 1, for each state S t . 

4. SiLi Prob(Si —» 5,) = 1, for each state 5,. 

5. Prob(S, —* S, ) = 0 for any instantaneous state 5,. 

6. Prob(S t —<■ S,) = l for any state S, with no transitions to others. 

In lieu of sufficient domain-specific information, remaining probabilistic weight is uniformly 
distributed in agreement with these conditions. 

5.1.2 Using Property Probabilities 

One typically also has some sense of the uncertainty in the observations. As explained in Sec¬ 
tion 2.3, such uncertainty is represented by the probabilistically-weighted, disjunctive properties 
given by DATMI’s quantity-space conversion tables or the property probabilities given directly 
by the OBSERVE predicates. 

Definition 5.4 (Property probability) Each property probability Prob{p = v) for a seg¬ 
ment is the discrete probability that the property named p has the value v for the actual behavior 
during that segment. 

For example, imagine a segment G g with k asserted properties of names pi,, - • • ,Pi k ■ Further¬ 
more, let Uj, be the value in state S 4 for the property named p,- t , for / = 1 to k. Then, the 
probability that the actual values of those k observed properties agree with the properties of 
5, during G g is: 

PROPS- PROB < P{G g , S, )) = Proh (p<, = v h ) • ... ■ Prob(p ik = v jk ). 

This composition assumes that each segment property is independent, which is most reasonable 
when the observations are never redundant. 

As mentioned in Section 2.4, all assertions of properties of a particular name over a given 
segment must agree both in the property values and the probabilities of those values. This can 
require a single segment to be partitioned into a sequence of neighboring segments all agreeing 
in the property values but significantly differing in the probabilities of those values. Such a 
history is referred to as a: 

Definition 5.5 (Globally-segmented certainty-partitioned history) A globally-segmented 
certainty-partitioned history is a globally-segmented history which is concise so long as each seg¬ 
ment property has roughly uniform probability throughout its segment , as determined by domain- 
specific thresholds. 

A globally-segmented certainty-partitioned history can require significantly more segments than 
a globally-segmented concise history for the same set of observations. However, when the sources 
of observations are unreliable and noisy, globally-segmented certainty-partitioned histories allow 
property probabilities to more finely weight the global interpretations according to the varying 
certainties in the observations. 
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Figure 5.2: Example pinterp-space with path-probabilities 

Each transition in a dependency path is labelled with its conditional probability. Note that 
the probabilities for non-spanning transitions between pinterps are half of the probability for 
the transition between the corresponding states. Also, the a priori probabilities for states in 
the first segment are given by the over-sized numbers next to those states. The composed 
path-probability for each pinterp are given in brackets. 


5.1.3 Locally Composing Path-Probabilities 

Figure 5.2 shows a simple pinterp-space for the envisionment of Figure 5.1. Path-probabilities 
axe shown for each pinterp based on the state and transition probabilities specified for that 
envisionment. Property probabilities axe ignored for this simple example. 

The path-probability of a pinterp P(G g ,S $ ) depending on P(G*,Sd) of the b-neighboring 
segment G& is defined in terms of the local state, transition, and property probabilities as: 

PATH-PROB C P{G j»5,)) = b-path-prob * 

PRaPS-PROB<P(G a ,S«i +1 )) • i-ProftfSd+i — S d+1 ) * 
PROPS-PROB(P(G s , 5 ^+ 2 )) • l-Prob{S d+ 2 — S d+3 ) • 

* # 

tf 

PRQPS-PR0BCF(G ir ,5,_2)) * h'Prob{S g - 2 — S a _t) - 
PROPS-PROBCF(Gj, * l*Prol>(S 9 -i — 5.) * 

PROPS-PROB (P(G^, S g )). 

If P{G 9f Sg) has a frontier-state best b-dependency path (ie. if there is no P(G&, 5^) it depends 
on): then b-path-prob = ProifS,), else b-path-prob — PATH-PROB (P(Gi, S<*)). 

This composition follows from the chain rule of basic Bayesian probability theory (Pearl, 1988). 

It is based on two conditional independence assumptions: 

1. For a given path, a state is only conditionally dependent on the state transitioning to it. 

2. Only property constraints and transition constraints are enforced. 

Condition 1 holds as long as the envisionment is not globally inconsistent. Condition 2 holds 
as tong as other constraints, such as durations, do not affect which dependency paths are used. 

Note the factor of | for each transition probability in the computation for PATH-PROB ( P{G gj S a )) 
shown above. This factor accounts for the fact that there axe two possible direct transitions 
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from some P[G f ,$i) to some state Sy: one to P[G g$ Sj) and another to P(G* t Sy) of the b- 
neighboring segment G *. So, in lieu of domain-specific knowledge, the value of Prob(Si —► Sj) 
is equally distributed between these two possibilities, yielding: Pro^PfG*, Si) P(G f ,Sy)) ^ 
^ Prob{$i — Sj) and Prob{P{G g ,Sj) — P(G # ,Sy)) = fPro*(S* — Sy). 

For example, for the pinterp-space given in Figure 5.2: 

PATH-PROB (P(Gi, S$)) = Proft(S s ) = 0-3 

PATH-PH0BCP(G 3 ,5 3 )) = PATH-PROB<P(Gi, S 3 )) - f Pr<*(S 5 — Si) ■ £*Fro 6 (Si — S 3 ) 

= (0.3){^)(^) = 0.024 

These compositions overestimate the probabilities for spanning-state and meeting-states 
paths, relative to hidden-transition paths. Over any one segment, spanning-state and meeting- 
states paths contribute one transition probability, whereas hidden-transition paths contribute 
one for each transition in that path. Such overestimation is often acceptable since it leads to 
simpler interpretations (i.e, ones having fewer state changes). 

To more accurately determine the path-probabilities, the duration of each segment must 
be short enough to eliminate the need for hidden-transition paths. In that case, transitions 
will occur simultaneously over all chains of b-dependency paths. However, this could require 
increasing the number of segments by a factor of iV, where jV is the number of envisionment 
states. This could increase DATMrs time cost by a factor of IV 2 , since DATMI has a worst case 
time cost that is quadratic in the number of segments. 

Another problem is that each Fro4(S # —► S M ) should depend on how long S a has been 
spanning. For instance, one might imagine a state-duration probability distribution indicating 
how the likelihood of a state persisting changes as the observed time span increases. DATMI does 
maintain upper and lower estimates of the time span of pinterps, as discussed in Chapter 6. 
However, except when these upper and lower estimates are identical or when the probability 
is uniform within these estimates, such probabilities could not be used by DATMI. Thus, DATMI 
currently does not reason about probability distributions over durations. 


5.2 Normalizing Probabilistic Interpretation Credibilities 

A pinterp’s path-probability represents the a priori probability that the interpretation path 
leading to it is the one that occurs. Such probabilities are sufficient for determining which 
interpretation is best. However, these path-probabilities are actually all underestimates. This 
is because there will also be a priori probabilities implicitly associated with each global path 
passing through pinterps which are not ACTIVE. 

So, finding the probability of a global interpretation which is conditional on the given obser¬ 
vations requires knowing the probabilistic weight U assigned to paths passing through pinterps 
which are not ACTIVE, Pinterps which are not ACTIVE are either INACTIVE or INCOMPATIBLE. 
Multiplying global path-probabilities by the normalizing factor F = -~p ensures that their 
total sum is 1, as desired. Significantly, this normalization process is not needed to determine 
the relative orders of interpretations. Thus, the orderings resulting from DATMrs pinterp-space 
maintenance with path-cost propagation is correct. 

Nevertheless, the normalized probability for an interpretation is necessary to determine how 
much confidence one should have in a particular interpretation. This is especially important 
because finding the “second best” interpretation in DATMI can require time exponential in the 
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number of states (see Section 3.5). So, if the best interpretation has a normalized probability 
of 1 / 1000 , then one might very well suspect that there are many alternative interpretations of 
similar likelihood. On the other hand, if its normalized probability is well over 0.5 then the 
best interpretation is clearly much better than the rest. 

5.2.1 The Normalization Procedure 

The amount of invalid weight U is determined by a segment-wise forward sweep across the 
pinterp-space, starting at the earliest segment. This sweep computes pinterp-probabilities for 
each pinterp P(G g ,S t ) based on the pinterp-probabilities of the ACTIVE pinterps of G a and 
b-neighbor(Gj) which can reach P(G a , S,). 

Definition 5.6 (Pinterp-probability) The pinterp-probabiiity of an ACTIVE pinterp gives 
the probability that an arbitrary interpretation goes through that pinterp. For an INACTIVE or 
INCOMPATIBLE pinterp , the pinterp-probability indicates the probability of that pinterp being the 
first non-ACTIVE pinterp for an arbitrary interpretation . 

Of course, any interpretation containing a non-ACTIVE pinterp is inconsistent with the obser¬ 
vations. Thus, the sum of the pinterp-probabilities for non-ACTIVE pinterps gives the total 
probabilistic weight (17) assigned to inconsistent interpretations by the local path-probabilities 
compositions. 

For each segment G g , the sum of the pinterp-probabilities for the non-ACTIVE pinterps of 
b-neighbor(Gj) and the pinterp-probabilities for the ACTIVE pinterps of G g should be at least 
I. It can be greater than 1 since several pinterps can occur during G ff , for hidden-transition 
interpretations. In practice, however, it is often slightly less than 1 due to underestimations, as 
explained in Section 5.2.2. 

DATMI computes the pinterp-probabilities of each pinterp of a segment G g as follows, where 
G* = b-neighbor(G a ). First, the value of the pinterp-probability of each pinterp P(G g , 5 ,) is 
initialized to 0. Then, for each ACTIVE pinterp P(Gj„ Sj), the product of the pinterp-probability 
of P(Gi, Sj) and Prob(P(Gt,, Sj) -*■ P(G a , 5,)) is added to each P(G a , S,)’s pinterp-probability. 
Alternatively, when G g is the earliest segment, then Prob(S a ) is added to each P(G a ,S a )’s 
pinterp-probability. ' 

The contributions of hidden-transition paths over G a are then added to these pinterp- 
probabilities. For each ACTIVE P(G a , 5,) where t ^ g, the product of the pinterp-probability of 
P(G a ,5t) and Prob(P(G g , Si) — * P(G a ,S a )) is added to each P(G a ,S,)’s pinterp-probability. 
After iterating over all pinterps of G a , the contributions of longer hidden-transition paths are 
incrementally added in the next iteration. The increase for each P(G a , Sj) in the previous iter¬ 
ation is used as the pinterp-probability of each ACTIVE P(G a , S,-) when computing the additions 
to each P(G g , S,) ’s pinterp-probability as above for the current iteration. Finally, when these 
iterations provide no new increases, each ACTIVE pinterp P(G g ,S t ) has its pinterp-probability 
multiplied by PR0PS-PR0B(P(G a , S,)) to give their final values. DATMI never iterates more 
times than the number of envisionment states for any one segment, since it ignores all updates 
that would result from feedback through cyclic hidden-transition paths. 

Figure 5.3 shows the pinterp-probabilities computed for the pinterp-space of Figure 5 . 2 . For 
example, the pinterp-probability for P(G 2 ,S 2 ) > s; 

PINTERF-PROB (P(G 2 ,S 2 )) = Proi(P(Gi, Si) — P(C 2 l S 2 )) ‘ PINTERP-PR0 B(P(Gi, Si)) + 

ProA(P(G 2 ,Si) — P(C 2l S 2 j) - PINTERP-PRGB(P(G 2 , Si)) 
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Figure 5*3: Normalizing the example pinterp-space 

ACTIVE pinterps are shown in bold circles. All possible transitions from all ACTIVE pinterps to 
all other pinterps are shown as arrows. The label of each arrow is the conditional probability for 
that transition (with the probabilities for non-spanning transitions between pinterps being half 
of the probability for the transition between the corresponding states). The a priori probabilities 
for states in the first segment are given by the over-sized numbers next to those states. The 
computed pinterp-probabilities are given in brackets. The sum of the pinterp-probabilities 
computed for non-ACTIVE pinterps gives If = 0.324 + 0.314 + 0.0672 — 0.7052 [F & 3.5). 


= (0,2) (Q.62) + (0.2) (0.336) = 0.1912. 


5,2*2 Issues in Normalizing the Pinterp-Space 

A few key points should be made about this normalization procedure. First* pinterp-probabilities 
for all ACTIVE pinterps, representing the likelihoods that the system passes through each of 
those pinterps, are determined as a by-product of this procedure. These pinterp-probabilities 
can be used for monitoring tasks to indicate the likelihood that interesting states actually occur. 
Furthermore, the normalizing factor F gives a rough measure of how constraining the given 
observation set is. If F is very small* then the interpretation space is not being constrained 
very much. Unless the normalized path-probability for the best interpretation is close to 1* that 
would suggest the need for more observations. 
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This normalization procedure never places more confidence in a pinterp or interpretation 
path than warranted by the specified state, transition, and property probabilities. However, it 
slightly underestimates the pinterp-probabilitie* (and thus U as well) because it conservatively 
avoids feedback due to acyclic hidden-transition paths. When computing the contributions of 
hidden-transition paths to P(G gf S § ys pinterp-probability due to a transition from a pinterp 
P{G §7 Si) f DATMI considers the the shortest possible cyclic path of the form S, ^S'* —*S f . This 
path is readily given by DATMI’s shortest-path lookup-table; let the number of transitions in that 
path be fc, DATMI avoids feedback to pinterp P{G gj S # ) from P(G ? , S+) by ignoring additions 
in P(Gg 7 Siy^ pinterp-probability when computing increases for P(G gj S 9 ) after iteration k - I. 
Underestimation can also result when duration constraints cause some otherwise consistent 
dependency path to be pruned. When such a pruned path consists entirely of ACTIVE pinterps, 
the probability assigned to that path is not recovered during normalization - even though that 
path is inconsistent. 

The complexity of this normalization procedure is within the bounds of DATMI y s overall 
complexity (see Chapter 7). It requires at moat 0(M ■ N • (2iV - 1) ■ JV) = 0(M • iV 3 ) time 
and 0(iV 2 ) space, where N is the number of envisionment states and M is the number of 
measurements. The factor of M accounts for there being at most M segments to sweep across 
during the segment-wise process. The first factor of N reflects the fact that there can be as 
many as IV ACTIVE pinterps in a segment G gj each propagating its pinterp-probability along all 
transitions from it to other pinterps. The factor of (21V - 1) indicates that there can be that 
many pinterps at the start of each of those transitions: N in b-neighbor(G^) and N — 1 in G g 
itself. And since each segment can have as many as N iterations during each sweep, there is one 
more factor of N . However, to even further reduce the time costs of normalization, one could 
cache each pinterp-probability. One would update the cached pinterp-probability for a pinterp 
P(G f y S 9 ) during a normalization sweep only if the status or path-probabilities of some pinterp 
for an earlier segment, or for G g itself, had changed since P(G g} S s )'$ pinterp-probability was 
last updated. 

Finally, consider a pinterp P(G g ,S 9 ) which has a transition to a non-ACTIVE pinterp. It 
should be noted that a useful alternative to DATMI’s normalization procedure is one which 
redistributes the probability for that transition to only those transitions which also start at 
P(G gj S 3 ). For example, consider a simple case where the envisionment has only two tran¬ 
sitions: Sj S{ and S 9 —► 5y, Now, assume for G g and its forward neighboring segment 
G f that pinterps P(G gj S 9 ) J P(G tf ,S t ), P(G gt Sj ), P{G f ,S s ) t and F(G/,£i) are ACTIVE and 
P(G ft Sf ) is INACTIVE. This alternative redistribution would equally distribute Prob(P(G g7 S 3 ) 

F(G/,Sy)) among the other transitions from P{G gj S s ) (i.e. Prob(P(G g ,$ 9 ) —► P(G gt S i )) J 
Prob(P(G g ,S a ) - P{G gf Sj))j Prob(P(G g , S 9 ) - P(G fj S a )) t and Prob(P{G g ,S a ) - P(G fl Si))) 

This alternative redistribution would yield the most-probable consistent interpretation, fully 
conditional on the particular set of ACTIVE pinterps. Maintaining the best working interpre¬ 
tation with such redistribution would require updating the transition probabilities for each 
pinterp as pinterps cease to be ACTIVE. It seems that such a scheme could be incorporated 
into DATMI’s pinterp-space maintenance without any change in DATMI’s worst-case complexity. 
In contrast, DATMI uniformly normalizes all the ACTIVE pinterps of each segment to give the 
consistent interpretation which best agrees with the a priori expectations; such redistribution 
does not change the working global interpretation. DATMI’s current preference for the a priori 
most likely interpretation which is consistent with the data seems useful because it is simpler 
and less sensitive to faulty data. 
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Chapter 6 


USING DURATION 
CONSTRAINTS 


Knowing how long things generally take can greatly constrain the interpretation space. For 
example, evaporation, boiling, draining, and pumping processes could all explain a decrease in 
the water level of a container. However, knowledge about the time that each process would take 
to empty a full container might eliminate some interpretations. Thus, evaporation might be 
ruled out if the container was observed to become empty too quickly. Likewise, if a continuous 
decrease in the water level takes longer than pumping all the water from a full container would 
take, then processes other than pumping must be occurring. 

This chapter shows how DATMI reasons about such constraints by: 

1. Representing estimates of duration and 

2. Applying these estimates to the pinterp-space, 

6.1 Representing Duration Estimates 

To determine how much longer an observed change can last, one must first determine two 
things: 

l. The exact state of the system before the change started. 

2 How much change has already occurred since then. 

DATMI loses such precise information by using only qualitative properties to describe pinterps. 
However, precise durations would be elusive even if DATMI could represent the exact states over 
time, since: 

1. Observations often incompletely specify the states anyways. 

2. Models often incompletely specify the influences on durations. 

For example, one cannot determine exactly how long it would take to pump water out of a 
container whenever the initial water level is not precisely known or the model does not indicate 
the exact equation for the pumping rate. 

DATMI circumvents these problems by using more-readily available duration estimates. It 
considers two types of duration estimates: 
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Definition 6.1 (State-duration) The state-duration of state S $ is an estimate of kow long 
the system can remain in S t . 

Definition 6.2 (Reach-duration) The reach-duration of state pair (S tr Sd) is an estimate of 
the time required for the system to reach Sd, starting in S § . This estimate holds over all acyclic 
state paths in the environment that connect S $ to Sd, 

These duration estimates are expressed as either: 

1 . upper/lower-bounds or 

2 . probabilistic distributions 


Upper and lower bounds on the durations of states and paths of states suffice to eliminate 
many interpretations which grossly violate common sense expectations. Such interpretations 
might otherwise be preferred by DATMI’s probabilistic or simplicity criteria. For example, imag¬ 
ine a state where the only change is water being drained from a container, for a system where 
such draining never takes more than a few minutes. An interpretation suggesting that this 
state lasts for hours might be the simplist interpretation consistent with the envisionment, but 
it would be inconsistent the upper-bound state-duration of a few minutes. 

Duration probability distributions generalise these bounds by allowing different probabilities 
to be associated with the arbitrary ranges of durations for a state or path of states. Duration 
bounds can themselves be viewed as duration probabilistic distributions having zero proba¬ 
bility for the durations outside the bounds and uniform probability for those within. Unlike 
upper/lower bounds, probability distributions can capture the notion that extreme durations 
are more unlikely than the durations near the average- Nevertheless, upper/lower-bounds can 
be more confidently determined and used, as the next two sections show. 

A state-duration lower-bound of / seconds for state S a is denoted Likewise, [5 a ] C7=u 

indicates a state-duration upper-bound of u seconds for state S s , The notation [S a ]£=“ com¬ 
pactly signifies both of these bounds. Functions D^{S t ) = i and Du(S,) = u are also defined for 
each state S„. For the reaching of state Sd from state S,, notations [S', SdU=Z»' [5, ^ Sd\ V u , 
and [S, Sd^ZT functions Dl(S, Sd) — t and D&(S, 5j) = u are likewise defined. 

Furthermore, duration probability distributions for state 5, and the reaching of Sd from S, are 
represented by the functions D(S,) and D(S t ^ Sd) respectively. 


6.2 Estimating Durations 

Some duration estimates can be obtained directly from the envisionment. For example, for 
a state 5, specified as instantaneous in the envisionment, [S.j^Tg must be true. Similarly, 
transition 5, —*■ Sd implies Du{S, ^ 5j) > Dl(5j), since the system may have just entered S t . 
At the very least, each state S t has [S,]^“ and each transition S„ —* Sd has [5, ^Il=o° > 
which can be further tightened by additional constraints. Also subject to further constraints, 
the distributions D{S 3 ) and D(S, ^ Sd) can begin as uniform distributions. 

Also, some estimates can be derived from other estimates. For example, whenever the upper 
and lower duration bounds are equal, the probability distribution must assign all probability 
(1.0) to that time point. More generally, a weak approximation of [5. S d \v-? can be 
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determined by findin g two special paths between S, and One path identifies the minimal 
sum (giving /) of state-duration lower-bounds and the other identifies the maximal sum (giving 
u) of state-duration upper-bounds. However, tighter bounds may exist for S 9 Sd since 
these individual state-duration bounds may themselves be too weak* So, when available, global 
constraints on the reach-durations should be used instead of these minimal and maximal state- 
duration sums, to provide tighter bounds. 

In any case, further constraints on the duration estimates require domain-specific knowledge 
not ordinarily available in an environment. For example, consider a state S a where water in a 
container is boiling. The state-duration upper-bound for 5, cannot be more than the time that 
it would take to boil away all the water in a full container. Consider a state S t from which a 
system transitions exactly when some conjunctive set of independent conditions axe met. The 
state-duration upper-bound for S c cannot be more than the maximum time that any of these 
conditions might remain unsatisfied. For instance, a state where water Sow through a pipe is 
stopped by a closed valve has a state-duration upper^bound of oo if that valve could remain 
closed indefinitely. Also, if there are alternative states to which a state S a can transition, then 
&U (S a ) is at most the maxi mum of the reach-duration upper-bounds for reaching those states 
from 5 a « State-duration lower-bounds can be determined analogously. 


6.3 Applying Duration Constraints to the Pinterp-Space 

During pinterp-space maintenance, only dependency paths consistent with the duration esti¬ 
mates are allowed. Without any loss of soundness or completeness in the interpretation space, 
DATMI only applies these constraints to the b-dependency paths. This is sufficient because a 
pinterp cannot be ACTIVE unless it has both an f-dependency path and a b-dependency path. 
Duration probability distributions are handled with two distinct processes: 

1 . Using duration bounds - for time ranges having probabilities of 1.0. 

2. Adjusting pinterp path-probabilities - over time ranges of probability less than 1.0. 

Adjusting and propagating pinterp path-probabilities for duration probabilities is discussed in 
Section 5,1.1. Thus, the remainder of this section discusses only the use of duration bounds. 
Reach-duration bounds allow verification of whether a candidate b-dependency path for 
P(Gb t Sf) from pinterp P(G g >S 9 ) can occur over segment G g . Figure 6.2 illustrates such a 
b-dependency path. The duration bounds for this path from P(G*,5/) to P(G^,5 a ) are given 
by [S/ 'v* SJ25-. The observed duration bounds for reaching P(G gi S s ) from P(G&,5/} are 
implied by the observed duration of segment G g and the state-duration bounds for the states 
in the path. Conservative upper (Pi/) and lower (Sl) bounds of the observed duration of 
P{G hi S f ) ^ P(G g ,S a ) are: 

B u = DURATION^) + Du{S a ) and B L - max(0^URATIQK(G 3 ) - Du{S f )). 

The state-duration upper-bounds for 5/ and S a are used in these expressions of Bu and Bl to 
account for possible spanning-state paths involving P(G&, 5/) or P(G gi S a ). The b-dependency 
path from P(G br Sf) to P(G gt S 9 ) is considered possible as long as these two intervals ([/,u] and 
[Bl»Pi/]) intersect each other. 

Alternatively, state-duration bounds allow one to determine when a chain of candidate b- 
dependency paths imply that a state S s is occurring for too long or too short a time. To assist 
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Figure 6.1: Example spanning of state S, over many segments 

State S M fully spans segments G* through G g , and partially spans G t _i, in the chain of b- 
dependency paths leading to F(G g , S # ), In this example, S g is distinct from Si, S^, and S 4 . 


in this determination, DATMI associates a minimum span-time (SPAN-TIME-MIK(F(G g , S,})) and 
a maximum span-time (SP AH - TIME-MAI (P(G g , S,))) with each pinterp F(G g ,S f ) as follows: 

Definition 6.3 (Span-time) The span-time of a pinterp P(G g ,S t ) indicates the minimum 
and maximum time over which state S M might be occurring continuously through F(G g ,Sj) in 
the current best interpretation leading to F(G g ,S*). 

Figure 6.1 illustrates such a spanning sequence, 

DATMI does not globally enforce all duration bounds. The polynomial-sized pinterp-space 
cannot represent the exponential number of possible reach-duration constraints between pin- 
terps of different segments. Instead, reach-duration constraints are only enforced locally for each 
individual b-dependency path. Nevertheless, some global constraint on durations is supplied 
by checking the span-time of each pinterp against the state-duration bounds. 

Thus, DATMI handles a subset of duration constraints whose enforcement is necessary but 
not sufficient. The resulting pinterp-space is complete but unsound since it can suggest inter¬ 
pretations which actually are not consistent with global duration constraints. This should not 
be surprising, since local constraint-satisfaction methods, like those of DATMI’s, are inherently 
prone to global inconsistences. The approach taken in DATMI is to perform polynomial-time 
maintenance of a complete pinterp-space which is mostly sound. One can then determine, in 
time quadratic in the number of pinterps in the interpretation, whether a particular interpre¬ 
tation is indeed globally consistent with all duration estimates - by testing each pair of those 
pinterps against the reach-duration constraints. 

6.3,1 Checking Spanning-State Dependency Paths 

During pinterp-space maintenance, the minimum and maximum span-times of each pinterp 
P{G g ,Sg) are kept up-to-date using the following definitions. The example in Figure 6.1 is 
referred to throughout this section. 

The base-span-time is the sum of the durations of all the segments that state S A fully 
spans in the best interpretation through F{G g ,Sbase-span-time clearly must include the 
durations of segments G t * through G/. However, the base-span-time must also include the 
duration of G g itself; recall that the interpretation indicated by the chain of b-dependency paths 
leading to F(G g , 5,) is defined to have S 9 as the last state in G g . 
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The span-time bounds should also account for the duration of S 9 occurring at the end of 
the segment G,*_i since P(G*^i,5 # ) is part of the best interpretation through P(G g ,S $ )» This 
partial span by S M occurs when P(G(_i,£,) has hidden-transition b-dependeney path. 

Let ux- others be the sum of the maximum state-durations of the pinterps of G^_i that 
are in the bnlependency path for P(G t _i,£,), not counting P(G^_i r 5 l ) itself. Similarly, let 
sin-othere be the sum of the minimum state-durations of those same pinterps. S 9 must last 
in G t -i for at least as long as DUUTION (G,-_ i) - max-others. However, by definition, S# must 
last at least as long as Dl(S $ ). Thus, the minimum duration of P(G f -~i, S,) is defined as: 

S& = min(Z?x.(^j)j^^ A TIQK{G|.i) - max-others). 

m 

Similarly, the maximum duration of S M in G»_i is at least max{Du(S,) J DURATION(Gf_ 1 ) - 
Min-others), However, if the b-dependency path for F(G;_i,£*) includes a spanning-state 
paths into G,», then this upper bound must be increased. This increase accounts for the pos¬ 
sibility that the spanning state spent most of its time in the previous segment. Let G& be 
the segment b-neighbor(G*_i) and let P(G&, Sd) be the pinterp of G& on which PfCi-^S,) 
b-depends. If the b-dependency path of P(G^i, 5 ,) begins with P(G&, Sd) ~+P{Gi-i, 5 d ), then 
state S<t is considered to span from G* to G*-|. Let span-adjust be Di(Sd) if such a spanning 
S d exists, otherwise let span-adjust just be zero. Now, the maximum duration of PfGt-^S*) 
is defined as: 

Sjj = max(Z?t7(^)i DURATIOHfG,--!) - min-others + span-adjust). 

Using these bounds on the duration of F(Gt_i,5*) yields: 

SPAN-TIME-MIN(F(G 5 ,5,)) = baae-span-time + Sl 

and 

SPAN-TIME-MAI( P{G §y £*)) ~ base-span-time + Sfj. 

When the span-time interval [SPAN-TIME-MIN(F(G g , 5,)) I SPAN-TIME-MAX(P(G sr , S s ))] fails 
to intersect the state-duration interval [£>£(£*),£?(/(£,)], the sequence of spanning-state b- 
dependency paths leading to P(G gt S 9 ) is globally inconsistent. To fix such inconsistency, at 
least one of those spanning-state dependency paths might be replaced with a b-dependency 
path to a state other than S 9 . 

Currently, the DATMI implementation only attempts to replace the last spanning-state fa- 
dependency path of a spanning sequence that exceeds the span-time upper-bound. However, 
one might also try replacing a spanning-state b-dependency path from the front or even the 
middle of the spanning sequence. For example, a fix for faulty data might suggest extending 
the front of a spanning sequence backwards over several earlier segments. If the extended 
span-time becomes greater than the maximum span-time, then one might want to replace the 
spanning-state b-dependency paths earlier in the sequence if retracting the fix. 

When either segment G* or G g is a frontier segment, the value of SPAN-TIME-MIN(P(G g , £ 5 )) 
may be underestimated. In that case the interval [ Di(S g ) t Dp(S,)j cannot be directly compared 
with [SPAN-TIME-MIN(F(Gj, SjJJjSPAN-TIME-MAXfFtGj, 5^))j. Nevertheless, it must always at 
least be the case that SPAN-TIME-MIN(F{G g , £,)) < Dv{S t ). 

6,3.2 Checking Hidden*Transition Dependency Paths 

During search for a hidden-transition b-dependency path for a pinterp F(G ? , £,), the minimum 
and maximum span-times of the partial hidden-transition path are incrementally updated as 
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Figure 6,2: Example hidden-transition b-dependency path 
The arrows indicate a hidden-transition path from F(G*,S/) to P(G tf J S t ). 


the path is extended. In discussing how DATMI updates these ■'pan-times, this section refers to 
the example hidden-transition b-dependency path of Figure 6,2. 

The maximum span-time of a hidden-transition path is the sum of the £>cr(?t)’ s f° r each 
P(G g ,S{) in the path- Similarly, the minimum span-time of this path is basically the sum of 
the J3 l(5*) , s iOr each PfG^S*) in the path. However, to provide a true lower-bound on the 
span-time, Dl(S 9 } and Di(Sf) must sometimes be omitted from this sum. Those omissions 
conservatively account for cases where a state at one end of the hidden-transition path spans 
into a neighboring segment. Such cases occur for a hidden-transition path from F(Ga,S/) to 
P(G ? ,S f ) whenever either: 

I- P(G 0 ,Sf) is the first pinterp of G g in the path or 

2 . f-neigkboring P(G/,S t ) has a spanning-state b-dependency path starting at P(G g7 S a ). 

The state*durations for such spanning states are omitted because their durations in G g can be 
insignificantly short when they spend all their time in the neighboring segment instead. 

If the minimum span-time of a partial hidden-transition path exceeds the DURATXdN{G g ) as 
the path is extended during search, then further extensions of that path are avoided. Search is 
aborted for such paths because any completion of that path across the segment would surely 
take longer than the segment was observed to occur. , 

Alternatively, if the maximum span-time of a candidate hidden-transit ion path is less than 
DDEATION(G ? ) l then that path cannot last long enough to account for the entire observed time 
of G g . Notice that this test can miss some duration violations. For instance, if S a spans from 
Gg into G/ and SPAH-TIME-MAX(F(G/, S f )) is greater than DURATION(G^), then there might 
still be a violation. In particular, if S a spends most of 5PAN-TIME~MAX(F(G/, S a )) in G/, then 
P(Gg,S 9 ) might not be able to last long enough to allow the hidden-transition path to cross 
G g . This example illustrates the inherent unsoundness of the pinterp-space when using duration 
estimates, as discussed in Section 6.3. 

DATMI also ensures that a candidate hidden-transition path from P(G^ > Sf) to P(G gj S s ) 
is consistent with the known reach-durations. The duration constraints on such paths that 
Section 6.3 presented in terms of bounds By and Bl can be tightened as follows. If the path 
actually involves 5/ spanning from G^ to G J? then these constraints must hold: 

D L {S f ^ S t ) < Bu = DURATION^*) + Du(S 9 ) 

Du{S f «+ S M ) > B l = max (0 JURATION (G # ) - Du(S f )). 

Otherwise, these tighter constraints must hold: ^ 
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D L (S f ^ S,) < Bu = DURATION{G fl ) + Du(S s ) 

Du{S f ^ S B ) > max(0, DUBATION(G tf )). 

Note that the bounds on Dt(Sf S B ) must still account for cases where S § spans from G 9 
to G/, This is because P{G §y S B ) itself cannot indicate such spans into G/ - the b-dependency 
paths of pinterpe in G/ do that. 

6.3.3 Checking Gap-Filling Dependency Paths 

The gap-filling paths given by DATMI’s path lookup-tab lee are not always consistent with the 
duration estimates. So, if the lookup-table gives a path violating the above tests for hidden- 
transition paths, a slightly modified DATMI dependency path search can find a more consistent 
gap-fill path. 

The basic idea is to treat as ordinary segments those gap-fill segments which cannot be 
consistently interpreted with the paths given by the lookup-tables. Thus, they have pinterps 
which trivially satisfy the property constraints since there are no segment properties constrain¬ 
ing them, As with all segment pinterps, these gap-fill segment pinterps must have dependency 
paths maintained for them. 

Of course, since there are no segment property constraints, there are likely to be many 
ACTIVE pinterps for such gap-fill segments. Thus, it is more efficient to handle gap-fill segments 
as ordinary segments only when the conservative duration estimates are contradicted. 


6.4 Problems with DATMI’s Duration Reasoning 
3.4.1 Incompleteness 

Incompleteness can arise m the pinterp-space when using duration estimates if either: 

1. Acyclic hidden-transit ion paths are needed to satisfy duration constraints. 

2, A pinterp is considered INACTIVE whenever it is inconsistent with the duration constraints. 

The polynomial-sized pinterp-space cannot represent cyclic hidden-transition paths. When 
ignoring duration estimates, acyclic interpretations would always be preferable and more plausi¬ 
ble than their cyclic counterparts. However, sometimes a segment might be interpretable under 
duration estimates only by using repetitions of some path of pinterps. Although DATMI does 
not currently do so, such cases could be handled by splitting the segments until each repetition 
would occur as a separate hidden-transition path. 

A pinterp which apparently has no b-dependency path consistent with the duration esti¬ 
mates cannot simply be marked as INACTIVE. For example, a spanning-state b-dependency path 
for a pinterp PfG^Sj) which is inconsistent with might actually be fixed by making 

the spanning sequence start at a later segment. It would be a mistake to mark P(G Jr 5 tf ) as 
INACTIVE if such a fix is possible. On the other hand, actually applying that fix could suddenly 
make the b-dependency path of some other pinterp conflict with the duration estimates. 

To handle this dilemma, DATMI allows pinterps which violate span-time bounds to remain 
ACTIVE, but explicitly marks them as duration violators. A candidate interpretation containing 
such a violator must then be specially verified against all duration constraints. These special 
ACTIVE pinterps will never appear in the working interpretation since they actually have no 
b-dependency paths. 
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6.4.2 Unsoimdneti 


As explained in Section 6.3, DATM's use of duration estimates is inherently unsound. DATMI’s 
limited ability to represent global context adds to this unaoundness. For example, let state S, 
represent the draining of a huge tank of water and state Sf be where this tank is completely 
full. If the system is first in state Sf and then moves directly into 5„ S , may last for very long 
time. Now, let state S t be where this draining has reached equilibrium, with half of the water 
in this huge tank and the other half in some adjoining destination tank. If 5, occurs just before 
S t , then maximum span-time of S, will be significantly less than if Sf occurs just before S,. 

Such contextual effects are not limited to the atate'occurring just before 5,. For example, 
consider this interpretation: a tank drains for 9.99 minutes, a valve blocks this draining for a 
while, and then the tank continues to drain again for 2 more minutes. DATKI does not realize 
that this interpretation is inconsistent with a maximum span-time duration of 10 minutes for 
the state where the tank drains. Although summing the durations of such interrupted states 
over the chain of b-dependency paths would solve that particular example, things are not always 
that simple. For instance, a pump may put enough water back into the tank between the two 
occurrences of the draining state to make both drainings consistent. 

One approach to maintaining these global contexts would a scheme where each pinterp 
could be represented by many alternative, annotated pinterps. The annotations would indicate 
special global information associated with the chain of b-dependency paths leading up to that 
pinterp. However, since the number of such pinterps would tend to grow exponentially as the 
one proceeds forward across the observational history, the number of these special pinterps 
would have to be limited. 
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Chapter 7 

COMPLEXITY- ANALYSIS 


This chapter analyzes the DATMI algorithm to determine its time and space complexity. This 
analysis shows that DATMI requires time at worst cubic in the number of environment states and 
quadratic in the number of measurements. Furthermore, it requires space at worst quadratic 
in the number of states and linear in the number of measurements. 

The worst-case time complexity is cubic in the number of states due to the worst-case com¬ 
plexity of hidden-transition search. However, as discussed in Section 7.5, the space complexity 
could be reduced to linear in the number of states by using a more concise, but less expressive, 
representation for dependency paths. In any case, reasons for expecting DATMI’a complexity to 
be much lower than these upper bounds will be suggested. 


7.1 Definitions 

Let the number of envisionment states be N , the number of measurements be M , and the 
number of observed properties for any one segment be P. The concise observational history 
will then have at most 0(M) global segments since each segment must have at least one 
corresponding measurement and there can be at most one gap-fiU segment between every non- 
gap-fill segment. The worst-case overall time complexity of incrementally maintaining the 
pinterp-space is 

and the worst-case space complexity for the pinterp-space is 

0(M(P+N 2 )). 

Although the complexities of the state lookup-table and path lookup-tables do depend 
on the total number of states, these factors are not as significant since these tables can be 
computed off-line for a given envisionment. In any case, the complexity measures given here 
for DATHI ignore the separate envisioning process. Envisioning itself might be performed before 
the interpretation task or incrementally during inteTpretation- 

The effective N for these worst-case complexity measures is the maximum number of states 
actually compatible with any one segment’s properties. For tasks such as process monitoring, 
most of the properties distinguishing the envisionment states will typically be carefully observed. 
Thus, the effective N will typically be a small fraction of the total number of envisionment 
states. 
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The effect of the number of observed properties on the effective value of N for DATMI com¬ 
plexity can be dramatic. For simplicity, assume that each of the V system variables considered 
in the envisionment have C possible values; then N < C v since there would be at most C v dis¬ 
tinct envisionment states. Although it is not reasonable to expect that each property assertion 
for a segment will reduce the number of pinterps by a factor of C , a large number Q of such 
assertions should result in an average of about N/C ® COMPATIBLE pinterps per segment. The 
ratio of possible pinterps to COMPATIBLE pinterps would then be at most C v /C®, or simply 
C v -<>. Thus, the effective N is expected to drop exponentially in the minimum number of 
properties asserted for each segment. 

Since gap-fill segments do not have any pinterps or properties, the effective M should be 
lower when there are such segments. Also, the effect P will usually be lower because segments 
rarely have the same number of properties. 


7.2 The Size of the Interpretation Space 

For an observational history of M segments, the search space contains possible global 

interpretations. Any path which has no state occurring more than once during any one segment 
is a potential interpretation for DATMI. There are O(iV^) acyclic paths consisting of 1 to N 
states. Each such path could be a local interpretation over a given segment. Although this 
4 interpretation space is exponential in N and M f DATMI finds its working global interpretation 
in polynomial time and space. 


7*3 DATMI Space Complexity 

The worst-case space complexity of 0(M - P + M - JV a ) is determined by the structure of the 
pinterp-space. The factor of M * P arises because each of the M segments can have as many as 
P properties that must be stored in the observational history. Each segment can also have as 
many as N ACTIVE pinterps which each can, at worst, have acyclic dependency paths consisting 
of every envisionment state except that of the pinterp itself; this explains the factor of Af / N 2 , 
This space complexity also happens to cover the cost of the lookup-tables; the state lookup- 
table requires 0(F * N) space and the path lookup-table requires 0(N 2 ). Since the original 
numerical measurements need not be retained after translating them into qualitative properties, 
no space costs other than those of the pinterp-space and lookup-tables need to be considered. 

Usually the space coat of the pinterp-space will be significantly less than the worst-case, 
because of the factors mentioned in Section 7.1. 

7.4 DATMI Time Complexity 

Since maintaining a pinterp-space is a constraint-satisfaction problem (CSP), theoretical CSP 
analyses (Mackworth Ac Freuder, 1985; Mohr Ac Henderson, 1986; Han Ac Lee, 1988) provide some 
insight into the time complexity of DATMI itself. For example, because the constraint graph 
formed by the pinterp-space dependencies is a tree-structure, the DATMI constraint propagation 
algorithms require only time linear in the number of segments to update the pinterp-space for a 
new observation. Maintaining the pinterp-space involves two fundamental processes that con¬ 
tribute to the time complexity: determining the effects of property constraints, with a cost of 
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0(M * P * iV 3 ), and maintaining the dependency paths, with a cost of Q(M* - P • AT 3 )* Together, 
these processes result in a worst-case time complexity of 0(Af 2 • P - N 5 ). 

7.4*1 Determining the Effects of Property Constraints 

The pmterps satisfying property constraints are determined by intersecting the sets of states 
given by the state lookup-table for each segment property Since each of the M segments may 
have up to P intersections of sets of size 0{JNT), the total time cost for deter minin g COMPATIBLE 
states is at most 0{M * P * AT 3 ). 

Although this cost is reasonable, in practice the cost is typically even lower. The effective 
N here will be even lower than suggested in Section 7.1 because each intersection of current 
segment states with the states compatible with a new property results in fewer states to check 
with the next property 

To further reduce the cost of determining segment consistency, the DATMI implementation 
uses an augmented state lookup*table with a cache indicating which states are compatible with 
some common subsets of properties asserted for segments during the course of processing new 
observations. Typically, only a small fraction of the observed system variables will change 
values between neighboring segments. Therefore, segments with many properties will usually 
be able to reuse much of the state-intersection work already performed when determining the 
set of states compatible with earlier segments. 

7,4.2 Maintaining the Dependency Paths 

The total time cost of incrementally maintaining the dependency paths over the course of 
asserting observations is at worst 0{M 2 - P * N 3 ). Each update of the pinterpHspace requires at 
most 0(M - N z ) time since a propagation sweep can require visiting M segments and searching 
for the best dependency paths for a segment's 0(JV) pmterps can require hidden-transit ion 
search of at worst Q(N Z ) time (see Section 3.7.3 for details)- By waiting to update the pinterp- 
space until all properties for a given segment are gathered, only O(JVf) pinterp*space updatings 
are required. However, in the worst case, the pinterp-apace is updated after each observation 
assertion; this would require as many as M • P updatings. Thus, the total worst-case cost of 
maintaining the dependency paths is 0((ilf * iV 3 ) - (M - P}) = 0(M 2 - P ■ iV 3 ). 

7.4.2,1 Why Maintaining Dependency Paths Is Often Still Cheaper 

This upper bound time complexity for maintaining dependency paths is greatly inflated, even 
when the factors of Section 7.1 are considered. For one, as discussed in Section 3 J.3, hidden- 
transition search is only as bad as ©(i\T 3 ) in those rare cases where exhaustive graph search for 
least-cost paths is actually required. 

AJso, updates can often be postponed until all the properties for a segment have been 
asserted. So, since most of the observations for a segment will typically be asserted before the 
observations of a future segment, one seldom needs to invoke many more than M pinterp-space 
updatings during incremental interpretation maintenance. 

And since a propagation sweep will rarely require going aU the way to a frontier segment, 
one of the factors of M in the complexity measure is too large. In fact, that factor of M is too 
large simply because earlier updatings when the observational history has not yet grown to M 
segments could not possibly require examining M segments. 
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Furthermore, this upper-bound on the time complexity does not reflect the improved ef¬ 
ficiency of using the pinterp dependencies. The efficiency of using dependencies is that only 
the fraction of neighboring pinterps actually depending on a changed pinterp need to have al¬ 
ternative dependency paths determined. Although using dependencies certainly improves the 
expected time complexity, there is no dear order of magnitude improvement in the worst-case 
time complexity. 

Intuitively, one would expect the overall DATMI time complexity to be greater when there 
are fewer observations at each time because the interpretation space will be larger when there 
are less observations constraining it. Since DATMI implicitly maintains this entire interpretation 
space, it should be more costly to handle a smaller set of observations. Yet, the given time 
complexity measure of 0(M* - F - IV 3 ) may seem to indicate that a smaller P leads to a 
lower worst-case time cost. However, in reality, changing F also changes the effective N> A 
lower P results in a higher effective N since more states will be compatible with a smaller, 
less constraining, set of properties. Thus, the intuition is correct - DATMI J s performance does 
improve with increased observations. In any case, DATMI still performs well with sparse data 
due to its polynomial worst-case complexity. 

7.5 Reducing DATMI Time and Space Complexities 

The DATMI algorithms for finding dependency paths, as described in Section 3.7.3, are somewhat 
inefficient. In particular, they find dependency paths for each pinterp independently of those 
for other same-segment pinterps, unless exhaustive graph search gets invoked. Since a hidden- 
transition path S of \S\ pinterps also immediately indicates valid dependency paths for the 
\S\ — 2 other same-segment pinterps, much of the independent search for hidden-transition 
paths can be redundant. For example, consider ACTIVE pinterps FfG^S*), FfG^S^), and 
F(G ? ,Ss) of segment G g with a pinterp FfG^S*) ACTIVE in neighboring segment G n . A 
dependency path F(G*,Si) —► F(G^,5j) —► F(G*,Sj) —* F(G n ,S 4 ) for pinterp P(G g7 Si) 
would also imply a dependency path P(G gj St) —► F(G*,5s) —> F(G n ,S 4 ) for F(G ?1 53) and 
F(G ff ,5 3 ) - F(G n ,S 4 ) for F(G fl ft). 

The redundancy in the existing search algorithms could be greatly reduced by integrating the 
search for dependency paths for all pinterps of a segment. Such integrated search would note the 
smaller dependency paths discovered when longer paths were found. It would also try extending 
known hidden-transition dependency paths. Furthermore, all hidden-transition dependency 
paths could be reduced from an explicit entire pinterp path to a concise representation where 
only the next pinterp in the path is given. Using the transition paths of the previous example, 
pinterp P(G gj S{) would have a concise dependency of just F(G tf ,S 2 ), pinterp F(G g ,Sj) would 
in turn have a concise dependency of F(G ff ,5s), and so on. The complete hidden-transition 
path for each pinterp would be immediately recovered by following these concise dependencies 
until a pinterp of the neighboring segment is reached. Using concise dependencies would reduce 
the space complexity of the pinterp-space by a factor of N since each of the N pinterps would 
then require only constant space for a dependency instead of 0(iV) space. 

Unfortunately, such concise dependencies and integrated hidden-transition search are not 
always desirable. As the example of Figure 7.1 shows, dependency paths cannot always be 
represented as concise dependencies when special constraints such as duration estimates and 
other global path constraints are considered. Note that while P(G g , Sj) b-depends on F(G ? , Si), 
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Figure 7*1; Example problem with concise dependencies 

The ranges [u,l] next to some states represent state-duration upper/lower bounds (in seconds) 
for those states. Assume the beat b-dependency path for P(G g ,Si) is F(G&, 53 ) —frP(Gj, S 4 ) 
—*P(Gj,£i) and the best one for P(G f ,Sj) is P(G*,S 5 ) —*P(G^,5i) —^FfG^Sa), A con¬ 
cise dependency for P{G ff 5 S 2 ) on P(G gf Si) would indicate a dependency path cf FfG^Sa) 
-♦FfG^, 1 S 4 ) —►PfG^, S\) — |, P(G tf , £ 3 ), which isn’t even consistent with the state-duration lower- 
bounds since DnRATION(G^) is only 6,0 seconds. 


P(G 0 ,Si) has a b-dependency path which FfG^Sj) cannot inherit from P(G ?f 5i). Doing so 
would violate the state-duration lower-bound constraints on the pinterps of G g . 

Such conflicts may be resolved by changing the dependency path of P(G g} Si) to some 
other path of equal path-cost or path-probability. However, the current dependency path 
for P(G g ,Si) might be uniquely optimal, especially if the path-costs or path-probabilities are 
defined rather precisely,-Besides, such resolution could require search time exponential in the 
number of ACTIVE pinterps for G 3 . Nevertheless, some hybrid scheme might be useful, when 
storage space is tight^ which allows concise dependencies except for pinterps that have special 
constraints preventing them from using the path which is indicated by a concise dependency. 
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Chapter 8 

DISCUSSION 


8.1 Summary 

This paper has presented the DATMI framework for solving a wide variety of interpretation 
problems. DATMI works on interpretation tasks that meet the following two basic conditions: 

• A total envisionment for the physical system can potentially be generated at the level of 
detail desired. 

• Domain-specific knowledge is available for translating the measurements into the qualita¬ 
tive properties of the envisionment states. 

The model can be of any ontology which satisfies these conditions. 

In addition to the above conditions, DATMI suffers from two other limitations: 

1 . It provides interpretations as linear sequences of states, which are not always the most 
appropriate representations. For example, partial orderings can provide more general ex¬ 
planations, but DATMI’s use of global segmentation and local dependency paths precludes 
them. 

# 

2. Its pinterp-space is complete but cam be globally unsound because: 

(a) It enforces reach-duration constraints only local to each segment. 

(b) It utilizes only observations which are temporally totally-ordered; global segmenta¬ 
tion cannot represent global trends or partial ordering constraints. 

Nevertheless, DATMI offers many key contributions by: 

1. Allowing conservative, probabilistic translations of numerical measurements into qualita¬ 
tive observations, which reduces the effects of faulty data. 

2. Maintaining a concise observational histon , which helps generalize interpretations. 

3. Incrementally interpreting observations as they are obtained. 

4. Providing key types of interpretations: 

(a) The best global interpretation, based on either costs or probabilities. 
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(b) A constrained space of ACTIVE pinterps, to simplify search for alternative interpre¬ 
tations. 

(c) Estimated probabilities of each state occurring during each segment (i.e. the pinterp- 
probabilities found during normalization). 

5. Finding hidden-transition and gap-filling paths as needed. 

6 . Using duration estimates to constrain the pint erp-space. 

7. Detecting faulty data and testing possible fixes. 

8 . Requiring time and space at most polynomial in the number of measurements and envi¬ 
ronment states. 

8.2 Related Work 

8.2.1 Qualitative Physics 

5.2.1.1 Q2 

Integrating quantitative and qualitative observational data is clearly desirable for constraining 
the interpretation space. DATMI, for example, uses the durations of segments to constrain the 
pinterp-space. Q2 (Kuipers & Berle&nt, 1988) also utilizes some types of quantitative infor¬ 
mation. It propagates quantitative intervals during history generation to prune inconsistent 
histories. 

However, using sufficiently detailed envisionments, the appropriate qualitative properties 
can often provide nearly as much useful constraint in DATMI as the numeric information that Q2 
handles. Consider, for example, an envisionment which differentiates states by comparisons of 
the rates of water Bowing into and out of a container. Qualitative values for this rate property 
can then be obtained from the original numeric measurements to constrain the interpretation 
space. 

To ensure that it can always offer some consistent interpretation, Q2 must be able to follow 
every branch during history generation, which can be exponential in the number of states. 
Although there are also an exponential number of paths through an envisionment, DATMI never 
needs to consider more than a cubic number of them (for dependency path search) because of 
the factorization provided by its global segmentation. Thus, Q2 is less suitable than DATMI for 
conservative monitoring tasks. 

Q2 uses a bottom-up process of extending its working histories to account for new observa¬ 
tions. In contrast, DATMI uses a top-down process of refining the expectations of the envision¬ 
ment by the new observations. Q2’s explicit representation of all global interpretations allows 
global constraints to be hilly utilized. DATMI limits the use of global constraints in return for 
polynomial-cost means for identifying the best interpretation and the states which can possibly 
occur during each segment. This trade-off generally distinguishes DATMI from other approaches 
as well. 


8.2.1.2 ATMS 

Attempts have been made to apply assumption-based truth-maintenance systems (ATMS) (de Kleer, 1986) 
to interpretation tasks, such as interpreting seismic events (Johnson et al., 1987), Sometimes, 
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an ATMS is indeed appropriate for measurement interpretation. By representing observations 
as ATMS assumptions, backtracking to handle incomplete data or faulty data can be avoided by 
using the ATMS to generate environments for each alternative interpretation. 

Unfortunately, using an ATMS to maintain a space of interpretations can be exponential in 
the number of assumptions. For interpreting steady-state behavior of a physical system with 
only a few uncertain observations, as in (de Kleer Sc Williams, 1986), this complexity might 
not be prohibitive. 

The time and space complexity of an ATMS seems too high for solving the across-time in¬ 
terpretation tasks for which is DATM1 designed. The main problem is that each DATMI pinterp 
would correspond to an ATMS node. For an observational history of M segments and an envi- 
sionment of N states, the ATMS could require 0(2**'^) time and space. This follows from the 
fact that there would be M * N pinterps, each being either ACTIVE or not depending on the 
activity of other pinterps. In contrast, the time complexity for DATMI is at most quadratic Af 
and cubic in N . 

8.2*1.3 ODE 

Another ATMS-based approach, GDE (de Kleer Sc Williams, 1986), provides an alternative means 
for handling inconsistencies between the measurements and the model. It is not directly suited 
for our problem because its focus is on determining the minimal set of faults in the system itself, 
not in the observations. Although it acknowledges sensor failure rates, it does not attempt to 
reason about the nature of such failures, as DATMI does with sensor failure hypotheses. Also, 
GDE does not reason over time. The consequences of using TCP (Williams, 1986) with GDE 
to allow across-time reasoning, which de Kleer and Williams suggest as future work, are not 
clear. Although TCP’s concise histories could represent partially-ordered interpretations, that 
approach would suffer from overhead that DATMI’s globally-segmented pinterp-space avoids. 

8.2*1*4 PREMON 

The predictive monitoring (PREMON) framework (Doyle et al., 1988) shares DATMI’s emphasis on 
using an explicit system model to provide expectations that can be compared with observations 
over time. It addresses the data selection problem of determining which sensor readings to 
focus on when one cannot process them all. However, PREMON does not attempt to maintain a 
space of consistent interpretations while it performs causal simulation. Thus, backtracking to 
handle faulty data would typically require complete resimulation using modified data. By not 
extending each working state with its many alternative next states during causal simulation, 
PREMON can often fail to detect anomalous behavior by being ignorant of the true state of the 
system. 


8.2.1.5 GTD 

Simmons and Davis provide another alternative framework for interpretation tasks based on 
the generate, test, and debug (GTD) paradigm (Simmons, 1988; Simmons Sc Davis, 1987). The 
GTD control Bow divides reasoning among three components: 

• Generator - Applies rules associating observation patterns with possible system behavior 
to obtain a hypothesis event sequence. 
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* Tester - Simulates the hypothesis event sequence using the system model to see if this 
behavior indeed results in the given observations* 

• Debugger - Determines problems with the hypothesis based on causal explanations given 
by the tester and then either; 

1 * Suggests fixes to the hypothesis sequence and testa the new hypothesis, or, alterna¬ 
tively, 

2. Quits trying to fix the hypothesis and instead reinvokes the generator to create a 
new hypothesis. 

By combining the efficiency of rules for creating initial hypotheses with the robustness of causal 
models to ensure that hypotheses are consistent with the observations and model, GTD appears 
to provide a solid foundation for solving interpretation problems. However, their work does not 
address the problem of translating numeric sensor readings to qualitative terms nor the problem 
of handling faulty data. Furthermore, GTD does not incrementally generate its hypothesis in¬ 
terpretation, handle observations at many times, nor maintain a space of consistent alternative 
hypotheses. 

8,2,1.6 Others 

DATMI *s quantity-space conversion tables are similar to mappings used in the 0[M] system 
(Mavrovouniotia <k Stephanopoulos, 1987) that maintains order of magnitude relations. For 
example, using 0[Mj notation, measurements indicating A ~> B (A is slightly greater than 
B ) translate into A > B and A = B properties. However, DATMI’s mappings can also have 
probabilities associated with them, to reflect sensor reliabilities. 

Work in the closely related areas of diagnosis, process monitoring and plan recognition 
address the same basic problems confronting measurement interpretation. The problem of 
selecting a sensor failure hypothesis explaining data conflicts has been addressed in work on di¬ 
agnosis. For example, one can use specifications of possible faults and their symptoms based on 
deep-level model expectations (Chandrasekaran h Punch EH, 1987; Scarl et al., 1987). DATMI 
theory provides a means for incorporating such generated hypotheses into the working inter¬ 
pretation space. Monitoring the handling of detected sensor or system component failures 
by maintaining contextual information of the status of problem recovery in an augmented 
transition network is suggested in (Kaemmerer ic Allard, 1987), Such an approach might be 
integrated with DATMI to manage which sensor failure and conversion failure hypotheses are 
currently being imposed on the interpretation space. 

8.2,2 Script-Based Reasoning 

Script-based reasoning is often a useful approach for interpreting the behavior of physical sys¬ 
tems (Laskowski & Hoffman, 1987; Schaefer, 1987). The appeal of scripts is that they can pro¬ 
vide explanations which are especially well-suited for the expected kinds of observations and 
behaviors. However, qualitative physics research strives to provide the deep models necessary 
to account for novel behaviors that were not originally considered. In that spirit, approaches 
based on qualitative physics models, such as DATMI, promise better coverage than script-based 
approaches. 
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8.3.3 Connectionism and Pattern Recognition 

Connectionist approachs, especially parallel distributed processing (PDP), have been success¬ 
ful at perceptual tasks such as classification and pattern recognition with uncertain numeric 
data (Rumelhart et al., 1987a; Rumelhart et al., 1987b). However, interpretation across time 
requires the ability to reason sequentially about context, which is not necessary for other per¬ 
ceptual tasks. Although supporting sequential reasoning with PDP frameworks is still largely 
an open research problem, the existing PDP TRACE model (McClelland <k Elman, 1987) has 
performed well on speech interpretation tasks involving single speakers uttering monosylla* 
bles. A key characteristic shared by both TRACE and DATMI is their dynamic maintenance of a 
space of possible interpretations consistent with the domain knowledge and currently available 
observations. 

In order to avoid segmentations which later contextual information would show to be incor¬ 
rect, TRACE makes no effort to maintain concise histories. Although concise segmentation may 
not be required for short speech utterances, interpreting system behavior over long periods 
of time could become excessively costly if the TRACE representation was used. DATMI avoids 
this problem by allowing segments to split as necessary when segment properties are changed 
to reflect faulty-data hypotheses or new observations. Furthermore, TRACE interpretations can 
only consist of one state (i.e. node in the connectionist network) per segment; thus, TRACE 
would misinterpret behaviors involving hidden-transit ions due to incomplete data. However, 
when the observations are sufficiently complete that hidden-transitions are not required and 
the observation period is short enough that the non-concise segmentations are not prohibitively 
expensive, TRACE might be applicable. In those cases, TRACE’S massively parallel relaxation 
methods might maintain a pinterp-space representation by assigning one pinterp to each node 
in its network. 

Alternatively, model-based measurement interpretation can be viewed as a form of tradi¬ 
tional structural pattern recognition. Interpretation based on an envisionment is similar to 
structural pattern recognition based on some grammar. The use of weightings in stochastic 
grammars to reflect uncertainty in the grammar or the data is analogous to DATMI's use of 
probabilistically weighted envisionments. 


8.3 Future Work 

Much further work is required to realize the full potential of the broad DATMI framework. Fur¬ 
ther developments in modelling, temporal reasoning, pmterp-space representation, data gath¬ 
ering, handling faulty data, dealing with uncertainty, and parallel algorithms will be needed. 

8.3,1 Modelling 

Advances in modelling could greatly Improve measurement interpretation. For example, order 
of magnitude reasoning (Raiman, 1987; Mavrovouniotis & Steph&nopouloa, 1987) is essential 
for integrating quantitative and qualitative knowledge as well as for handling differences in 
time-scale (Kuipers, 1987). Also, modelling the relative likelihoods of various physical pro¬ 
cesses (D*Ambrosia, 1987) and conditioning the plausibilities of conjunctive behaviors on these 
likelihoods would provide additional interpretation preference criteria. Modelling systems at 
several levels of abstraction (Falkenhainer Forbus, 1988) would allow interpretations which 
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only make significant distinctions among properties - Such abstractions can also make the total 
envisioning process more tractable. 

DATMI could perform system identification tasks by combining total environments of several 
systems into one composite envisionmcnL Since DATMI *s time and space complexity is at worst 
only cubic in the number of environment states , the larger number of states in such composite 
environments need not be prohibitive. 

8*3*1.1 Incremental Envisioning 

Totally environing a physical system can lead to a number of states and transitions which is 
exponential in the number of system variables. To ensure tractable temporal reasoning during 
interpretation, the DATMI implementation currently assumes that an existing total environment 
is available before interpretation begins. We suspect that such clean separation of envisioning 
from interpretation is more efficient for cases where a large fraction of envisionment states are 
likely to occur or where the observations are very sparse. This intuition is based on the efficient 
techniques developed for total envisioning, such as those described in (Forbus, 1990). 

The other cases would perhaps be bait handled by using some kind of incremental! envision¬ 
ing during the interpretation process. Such incremental envisioning would augment a working, 
partial envisionment with additional states and transitions as needed. New states and tran¬ 
sitions would be requested at least whenever DATMI detected an inconsistent segment. These 
new states and transitions could then be incorporated into the pinterp-space using the adjust¬ 
ment operations that DATMI currently uses for recovering from faulty data. We are currently 
exploring this direction. 

8* 3,1*2 Concise Envisionments 

A concise envisionment could be formed by partitioning an envisionment into sub-envisionments 
which each indicate the possible behaviors of non-interacting sets of system components. Ir¬ 
relevant temporal orderings of the behaviors of non-interacting system components would not 
be represented in a concise envisionment. Such envisionments would have many fewer states 
and transitions than the total envisionment representing the same behaviors. As a first start, a 
system modelled in QP theory could have each sub-envisionment indicate the behaviors of one 
p-component (Forbus, 1984). 

Such concise envisionments would provide smaller envisionments, reducing DATMI’s complex¬ 
ity. However, handling those rare states where such components could actually interact would 
require extending the DATMI framework to allow some pinterps to represent those interaction 
states. Pinterps representing interaction states would require multiple dependency paths which 
simultaneously reach the various partial states that represent the behaviors of non-interacting 
sets of components during a neighboring segment. Thus, each global interpretation might in¬ 
volve some simultaneous paths of partial states across some of the segments. 

8.3.2 Temporal Reasoning 

Partial temporal orderings among DATMI property assertions could further constrain the inter¬ 
pretation space. By supporting the full range of temporal relations defined in Allen’s temporal 
logic (Allen, 1983), even a very incomplete observation could greatly constrain the working in¬ 
terpretation space. For example, noting that a property p\ occurs some unspecified time after 
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some pt) one could eliminate all interpretations where pj actually occurs before p\. Unfortu¬ 
nately, only one instantiation of these temporal orderings can be represented by DATMI since it 
globally segments the observations. 

An alternative to global segmentation is provided by Williams 5 temporal constraint proper 
gator (TCP) (W illiam s, 1986), which allows such partial temporal-ordering relations* However, 
it is unclear how a pinterp-apace could be maintained with TCP* It seems that each alternative 
global segmentation of TCP's concise history would have to be represented to allow pinterps to 
be maintained. Only a subset of this intractably large set of alternative global segmentations 
could be considered. Without explicitly reasoning about all these alternative global segmenta¬ 
tions, the interpretation space may fail to cover the actual behavior or even become inconsistent 
due to faulty data* As Dean and Boddy (Dean & Boddy, 1987) point out, determining whether 
two actions are independent may, in fact, require considering all total orderings to ensure there 
are no significant interactions* 

Much of the constraint imposed by observations is local to each segment since the prop¬ 
erties of each segment locally determine which pinterps are COMPATIBLE. Yet, for most real 
interpretation tasks, some of the available observational constraints will not be local. For ex¬ 
ample, one may note that there is a change in some system variable over some interval of time 
without being able to determine exactly when the change occurs. Call such a global constraint 
an occurs- within constraint. These constraints are especially useful for noting that a change 
occurred between two measurement points that are not close enough to confidently make any 
property assertion. 

Occurs-within constraints could be expressed using weak temporal orderings. One could 
represent them in a pinterp-apace by selecting one ordering and allowing backtracking. Unfor¬ 
tunately, the resulting pinterp-space would no longer cover all consistent interpretations. Al¬ 
ternatively, if there were only a small number of occurs-within constraints, a candidate global 
interpretation could be tested against them. 

One may also wish to forbid certain paths of envisionment states from the interpretations. A 
need for forbidding such paths may result from a problem with envisionments first identified by 
Kuipera (Kuipers, 1986): some paths through an envisionment may not be globally consistent 
with the underlying physics. One means of handling such global constraints would be to use 
techniques such as logic of occurrence (Forbus, 1986b) to propagate global information such 
as changes in energy. Furthermore, the envisioning process itself might be able to identify 
particular paths of states which are found to be globally inconsistent but which cannot be 
explicitly denoted as so by the envisionment J s state-transition graph representation. As with 
other such global constraints, DATMI could then test candidate global interpretations against 
them. 


8*3.3 Compact Pinterp-Spaces 

As discussed in Chapter 2, a globally-segmented concise history is maintained by merging seg¬ 
ments which have identical segment properties and similar confidence levels for those properties. 
One might consider also merging any two neighboring segments whose sets of ACTIVE pinterps 
correspond to the same states, since those segments differ only in seemly insignificant property 
values. The segment properties for the merged segment would be the intersection of the prop¬ 
erties of those two segments. For example, conservative translation of measurements may have 
given segment G g a disjunctive property value of INCREASING V STEADY for its property named 
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p while a neighboring segment G n asserts only the value INCREASING for its property named 
p. If none of the ACTIVE pinterpe of G g would become INCOMPATIBLE if the value of STEADY 
was not asserted for G/s property named p } then that value of STEADY could be discarded as 
needlessly conservative. The above condition holds if the ACTIVE pinterps of segments G g and 
G n correspond to the same states. 

Although the space of valid interpretations would not change, merging segments G g and G n 
if they had corresponding sets of ACTIVE pinterps would better summarize the possible behaviors 
during those times. Of course, the risk of this method is that faulty data can mislead one into 
believing property values are unnecessary when in fact they are not. However, conservative 
translations of measurements into segment property assertions have been empirically noted to 
result in many neighboring segments that differ in unnecessary property values. Thus, such 
mergers might be required in practice to avoid very fragmented global segmentations when 
conservatively interpreting many measurements for many system variables. 

Further reduction in the size of the pinterp-space can be obtained by discarding long-past 
segments. Indeed, if one is monitoring a system over a period of weeks with rapid sampling, 
it would be of little utility, and perhaps even infeasible, to maintain a full pinterp-space over 
the entire observation period - unless the measured system variables are slow to change qual¬ 
itatively. At the very least, one might summarize very old segments by discarding seemly 
insignificant property values for segments that have not had any changes in their pinterp de¬ 
pendencies after observing many segments after them. Any effects on those old segments due to 
faulty data would probably have been detected, if ever, by the time that so many later segments 
have been observed,. 

If only the best global interpretation is being sought, then the pinterp-space can also be 
compressed by discarding alternative ACTIVE pinterps for all segments before a convergence 
segment Each convergence segment has either zero or one ACTIVE pinterps - zero if it is also 
an inconsistent segment. Status changes for pinterps of segments on one side of a convergence 
segment Gq cannot cause status changes for pinterps of segments on the other side. If no new 
property assertions are going to be made over time periods before G*?, then the best global 
interpretation up to Gq cannot change. Thus, one could discard all ACTIVE pinterps in the 
earlier segments not contributing to that best interpretation. 

This method might require recovering some of those discarded pinterps when the data 
observed so far was actually faulty. For example, Gc may get alternative ACTIVE pinterps due 
to the application of some fix-hypothesis. Then the previously sole ACTIVE pinterp for Gc may 
be filtered due to some later segment property assertions. In such a scenario, some discarded 
ACTIVE pinterp of a segment Gp preceding Gc may be required to provide dependencies for 
some pinterp of Gc* 

As this section indicates, future work towards a more compact pinterp-space must balance 
the advantages of compression with the difficulties of recovering discarded information to handle 
faulty data. 

8.3*4 Active Data Acquisition And Data Selection 

Active data acquisition is crucial for many important interpretation tasks where the number of 
potential observations is great but the number which can be made at any one time is small. 
For example, an airplane pilot must constantly decide in real-time which of the many gauges 
to read to adequately determine the status of the plane. Because dynamic data which are not 
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acquired are typically loot, deciding which data to gather at any particular time is of great 
urgency. Alternatively, data selection involves selecting among recorded observations to find 
those which best constrain the working interpretation space. 

Data selection is easier than data acquisition because the space of possible data is much 
more restricted and there is no need to decide how to actively search for new data. Nevertheless, 
data acquisition and data selection are both difficult problems. In the DATMX framework, these 
problems might be addressed by trying to reduce the number of ACTIVE pinterps for each 
segment. Segments with many ACTIVE pinterps indicate times over which the behavior is most 
ambiguous. For example, one might prefer observations at times nearest the segments having 
the most ACTIVE pinterps, since those observations are most likely to affect those segments. In 
any case, much future work is required to provide the data selection skills of a human nuclear 
powerplant operator or the active data acquisition skills of an experimental scientist. 

8,3*5 Handling Faulty Data 

A blackboard architecture (Hayes-Roth, 1985) would make the generation and selection of 
DATMX fix-hypotheses more robust and adjustable. The original numeric measurements, trans¬ 
lated properties, and the pinterp-space itself would be the main data structures upon which 
the many knowledge sources could operate. Knowledge sources specializing in translating from 
numeric to qualitative properties and assigning confidence levels to these translations could 
be used. Knowledge sources for each fix-hypothesis class could help determine which of the 
competing hypotheses to try next. 

Also, instead of simply forgetting properties when trying to fix an inconsistent pinterp-space, 
one could try to actually reevaluate the original numeric data after changing some parameters. 
For example, one could retranslate some property p using different sample time parameters 
MXN-ST(p) and MAX-ST(p). Alternatively, one could smooth the data signals with a different 
window size to change the sensitivity to the original fluctuations in the data. Indeed, one might 
even determine the entire qualitative space of smoothed signals (Witkin, 1983) and then select 
one that provides a consistent interpretation. However, the computational cost of computing 
the entire scale-space or even selecting a scale that leads to a consistent pinterp-space could 
easily become prohibitive. 

8*3*6 Reasoning Under Uncertainty 

DATMI provides some means for incorporating measures of certainty into interpretations to 
reflect confidences in observational data and a priori likelihoods of particular behaviors. How¬ 
ever, the integration of the wide-vanety of alternative methods for dealing with uncertain 
information into the DATMI framework warrants further exploration. For example, qualita¬ 
tive measures of uncertainty (such as endorsements (Cohen, 1985), partially ordered certainties 
(Rosen-Kraut z, 1981), and modal logics of likelihood (Halpern U Rabin, 1987)) might allow 
even weak knowledge about the relative certainties in observations and state and transition 
likelihoods to be used to further bias the pinterp-space. Path-probability intervals based on 
the concept of certainty intervals (Shafer, 1985) might allow imprecision and ignorance about 
the certainties in observations and state and transition likelihoods to be reflected in the path- 
probabilities. These path-probability intervals might be tightened as additional information 
focuses the range of path-probabilities most consistent with all available information. 
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8.3.7 Parallel Algorithms 

Although DATMI is currently implemented as a sequential LISP program, parallel algorithms 
for several key processes could greatly increase the overall efficiency of DATMI. Naturally, the 
initial data smoothing and segmenting steps could be done in parallel. Since the DATMI propa¬ 
gation procedures proceed in a segment-wise fashion, dependency paths for each pinterp of the 
current segment could be sought by individual processors simultaneously. With M segments, 
p properties in any segment, and N envisionment states, N processors could reduce the time 
complexity of DATMI propagation from 0(M 2 • P • IV s ) to 0(M J - P ■ N 2 ), Furthermore, the 
activation propagation sweeps for each seed-segment during pinterp-space adjustment could 
each be performed simultaneously. 

Parallel algorithms could also improve the efficiency of generating and using the DATMI 
lookup-tables. The state lookup-table could be generated for each state independently, in time 
linear in P and constant in N, using N processors. The shortest-path lookup-table could also be 
generated for each initial state independently, in linear time in N (or in quadratic time for the 
least-cost-path lookup-table), again by using N processors. Accessing the state lookup-table 
to gather the states compatible with P properties using P processors would cost 0{N 2 • lg(P )) 
time versus the current 0[N 2 • P) cost since parallel intersections of sets of states could be 
performed. 

8.4 Conclusions 

DATMI provides a modular framework for interpret’ ug the behavior of physical systems. Since 
it separates the interpretation process into distinct modules for modelling, translation, seg¬ 
mentation, pinterp-space maintenance, and fault recovery, further research can focus on these 
areas individually. For example, advances in qualitative modelling would provide better en- 
visionments without requiring the other modules to change. Likewise, more efficient, perhaps 
parallel, hidden-transition path-finding algorithms would only affect the pinterp-space mainte¬ 
nance stage. 

By viewing the interpretation task as a process of incrementally constraining an interpre¬ 
tation space, all interpretations currently consistent with the given observations and system 
model are available. Thus, DATMI is well-suited for process monitoring tasks where it is impor¬ 
tant to detect the possibility of undesirable behaviors occurring. Also, having immediate access 
to alternative interpretations, via the dependency paths, reduces the amount of backtracking, 
required to handle incomplete or faulty observations. 
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APPENDIX A 


THE QPE PUMP-CYCLE TOTAL 
ENVISIONMENT 


This appendix describee the pump-cycle model used for the DATMI examples shown in Ap¬ 
pendix B. As shown in Figure A.I» this pump-cycle consists of two identical containers of water 
connected by a pump and a valved-pipe. When the pump is OH and the valve is OPEN, water 
Sows through the pump from CAN1 to CAN2 and through the pipe from CAN2 bade to CAN1, 
forming a cycle. 


CAN 1 CAN 2 



PUMP 


Figure A.l: The pump-cycle scenario 


This pump-cyde system was modelled with Collins 5 and Forbus 1 thermodynamic domain 
QP models (Collins & Forbus, 1990). The total envisionment for DATMI was given by QPE 
(Forbus, 1990) using these domain models and a description of the pump-cycle scenario. Aug¬ 
mented envisioning techniques (Forbus, 1989) provided the transitions between states which 
differ in the statuses of the pump and valve. Thus, changes in the pump and valve were mod¬ 
elled as the results of actions by external agents and other external causes, such as component 
failures. 

The table of Figure A.2 indicates the values of each interesting property for each of the 
42 states of the total envisionment. Each column of this table represents the particular state 
indicated by the number given at the top of that column. Likewise, each row indicates the 
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value for the property of the name given at the left-hand side of that row. For example, this 
table shows that in state S\ the system consists of two empty containers, the pump is OFF, and 
the valve is CLOSED. 


m - (iMuiT-or-u vim liquid cud 
qs - UMUir-or-n vim liquid cm) 
qs - (rmv-iiix pith) 

W - (runr-uis pump) 


QS - (FLUID-LEVEL CUD 
Q« - (FLUID-LEVEL CU3) 
QT - (M12-PIESSU1X PUMP) 
Q8 - (PIESSUU PUMP) 


Prop«rty/ftt«t« till*; 
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Figure A. 2: Summary of state properties for the pump-cycle system 


In addition to defining the state properties, the total envisiomnent also indicates the valid 
transitions among these states. The graph of Figure A.3 shows all of these state transitions. 
For example, if the system is in state S\ then it can transition into state where the two 
containers are still empty but the valve is now OPEN instead of CLOSED. 
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States and Transitions 



Figure A.3: State-transition diagram for the pump-cycle system 
States 8, 9, 10, 11, 14, 15, 16, 18, 19, 20, 25, 31, 37, and 38 are instantaneous states. 



APPENDIX B 


DATMI EXAMPLES FOR THE QP 
PUMP-CYCLE SYSTEM 


For these examples ? DATMI used the total environment described in Appendix A- The mea¬ 
surements for each example were obtained from numerical simulations of the pump-cycle. For 
each example, this appendix describes the status of the piuterp-space at various key points 
in the dynamic process of interpreting the stream of measurements* Although DATMI has 
been used for many interpretation tasks, including the PHINEAS (Falkenhainer, 1988) project, 
a representative set of examples is provided by this appendix along with Appendix D. 


B.l Handling Sensor Failures with Property Adjustments 

B.1.1 Example 1: Failure of the Pump Indicator 

This example illustrates how DATMI handles faulty data which arise from sensor failures. An 
inconsistency is detected when water Sow through the path is observed even though the water 
levels seem equai and the pump is observed to be OFF* The envisionment indicates that states 
where the water level of CAN! is not greater than the water level of CAN2 cannot have water 
flowing from CAN1 to CM2 unless the pump is ON* As will be shown, DATMI resolves this incon¬ 
sistency by doubting observations of the PUMP status. Figure B.l illustrates the portion of the 
envisionment that provides the best working interpretations over the course of this example* 
The first snapshot. Snapshot 1 - 1 , of the pinterp-space shows that an inconsistency is detected 
when the pump is observed to be OFF (for the property named F4) during segment Seg32 
(G 33 )* Each row of these snapshots indicates the segment properties and pinterp statuses of 
the particular segment indicated at the left-hand side. INCOMPATIBLE pinterps are indicated by 
a u *, ACTIVE pinterps by a or a digit, and INACTIVE pinterps by a or 

The property name abbreviations F3, F4, FT, F 8 , and FlQ used in these snapshots are 
defined in Figure A.2* For example, ail the pinterps for segment G\ (Segl) are INCOMPATIBLE 
except for ACTIVE pinterps F(Gi, 5 i 7 ) and F(Gi, 5 s 9 ), Also, the observed values for each 
property of G\ are: 

• F3: “The water level is greater in CAN 1 than in CAN2*” 

• F4: “The pump is OFF*” 
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Figure B.l: Portion of the pump-cycle envisionment 
(Arrows indicate direction of change in the water levels and the water flow) 


• F7: “The water level in CAN1 is steady.” 

• F8: “The water level in CAN2 is steady.” 

• FlO: “There is no change in the rate of water flow through the pipe.” 

During G 32 , the properties for FT, F8, and F10 indicate that water is moving from CAN1 to 

CAN2. However, since F3 suggests that the water level of CAH1 is not greater than that of CAN2, 

it is impossible for such changes in the water levels to occur in this system without the pump 
being ON. Thus, G 32 has no COMPATIBLE pinterps, which means it has no ACTIVE pinterps. So, 
G 32 is an inconsistent segment that must be fixed. 

Snapshot 1-1 also illustrates a few other aspects of DATMI. First, the property for F3 has the 
disjunctive value of “less-than or equal-to” over Gjj because the numerical measurements of 
the water level in CAN 1 were just slightly less than the measurements of the water level in CAN2. 
DATMI *s quantity-space conversion table allowed imprecise sensor readings to be conservatively 
interpreted* Similarly, no value for F3 during G 30 is asserted because the measurements for 
G 30 did not satisfy the noise window (recall Section 2.3) for F3. This occurred because the 
change from to “< or for F3 occurred at some indeterminate point during G 30 . 

Also, the for F(Gis, S 19 ) indicates that 5ig cannot occur during G 15 because of conflicts 
with duration estimates. In particular, F(Gis,Si 9 ) could only be ACTIVE if S 19 spanned from 
Gii to G% 5 * No other ACTIVE pinterp of G u other than F(Gn,Si 9 ) could reach F(G*S|£i 9 ) 
using state transitions through ACTIVE pinterps of Gn and Gjg. However, S\q cannot span 
because S 19 is an instantaneous state with DpfSig) = 0 , Note that F(Gu,Si 9 ) itself does 
not similarly conflict with the duration estimates because it can b-depend on F(Gio, S 17 ) and 
f-depend on F(Gru>£ 41 ) F(Gis,S4i). 


89 









Snapshot 1-1: INCONSISTENT 

••••• Inconsistent aagasat <Sag 32> detected! ***** 
111111111122222222223333333333444 

123466789012345678901234667800123466789012 P3 P4 P7 P8 P10 


Segl: .•......1... > F 0 0 0 

SegO: .#.1... > 0 0 0 

SeglO; ..#.#.l.». > 0 

Segll: .#.1. > T - + 0 

SeglS: .—. #1 > T - + 

SeglS: .-.1 > T - + + 

Seg22; ....#.l > + + 

Seg24: .-.1.. > F - + + 

S«g30: ..-.1.. F - + + 

S«g32: . (< -) F - + + 

se g 33: rrr?rr?rrrr?Trrrmrrrrrr?????7??7?7???7rf 


To fix an inconsistent segment, DATMI tries to forget all the segment properties of some 
name that have the most recent value. As Snapshot 1-2 shows, forgetting PlO for its most 
recent value of “+” does not remove the inconsistency, though it does make some more pin- 
terps COMPATIBLE, like P(Gia,£u>) and P{Gn, S*i). Note that no pinterps COMPATIBLE in 
Snapshot 1-1 are now INCOMPATIBLE in Snapshot 1-2. This a useful conservative feature of 
forgetting segment properties instead of actually changing their values. 

Snapshot 1-2: INCONSISTENT 

Try SENSOR-FAILURE FIX-HYPOTHESIS: 

Forget PlO fro* <Seg 15> to <Seg 32> ... 

***** Pinterp-space still inconsistent at <S«g 32>! ***** 

111111111122222222223333333333444 

123456789012345678901234S678901234S6789O12 P3 P4 P7 P8 PlO 


Segl: .#..... 1 ... > F 0 0 0 

Seg9: .#.1... > 0 0 0 

SeglO: .#.#.1.#. > 0 

Segll: .*.1. > T - + 0 

SeglS: .—. #1 > T - + 

SeglS: .—.#1 > T - + 

Seg22: .......##1 > + 

Seg24: .-...1.. > F - + 

Seg30: ..-.1.. F - + 

Seg32; . (< -) F - + 


Having failed to make the pinterp-space consistent, the forgetting of PlO must be retracted, 
resulting in Snapshot 1-3. G 32 again becomes inconsistent since the pinterp-space is now as it 
was before PlO was forgotten. Forgettings of other properties are similarly tried and retracted 
until one works or until forgetting? of the recent properties of each name have been tried. 
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Snapshot 1-3: INCONSISTENT 


Retract fix-hypothesis <FLx-l {Forgot P10>> ... 

***** Retracted fix-hypothesis <Fix-l {Forget P10}>! *•*•* 

1234S67890123466789012346678901234S6789012 P3 P4 P7 P8 F10 


Ssgl: .....#..,.......1... > F 0 0 0 

SegQ; ....t... > 0 0 0 

SeglO: ....1.#, > 0 

Segil: ...-- 1- > T - + 0 

SeglS: . #1 > T * ♦ 

SeglS: ... I > T - + + 

Seg22: ......#.l > + + 

Seg24 : ,,_ i.. > F - * * 

S«g30; ....1*. F - ♦ + 

Seg32; .... (< ■) F - + + 


The forgetting of P4 succeeds in giving Gjj some ACTIVE pinterps, as Snapshot 1-4 shows. 
Forgetting all the most recent occurences of P4 having value a F" acknowledges that the pump 
status indicator light may have burnt out sometime after Gxa and falsely indicated that the 
pump has been OFF since G24. 

The best global interpretation across the segments at this point is given by the chain of 
pinterps noted as ACTIVE in Snapshot 1-4 by the digits instead of Such digits indicate the 
temporal order of pinterps in hidden-transit ion paths. Thus, the global interpretation crosses 
over Gjq with P(G3o,Ssa) followed by P(Gjoj^ 32)- Note that domain-dependent probabilistic 
knowledge is used to determine the best global interpretation. For example, the best global 
interpretation starts at PfG^Sg*) instead of P(Gi,5i7). This is partly because S\r is the a 
priori unlikely state where all of the water is in CAN1. S39 is a more likely state where both 
have some water. 

Having removed the inconsistency, DATMI is able to interpret the rest of the observations, 
as shewn in Snapshot 1-5. All observations of P4 after G32 suggest value “F” for P4 because 
the pump indicator has burnt out by then. These later *F* values are ignored because the 
fix-hypothesis for P4 is active since G33, This acknowledges that this indicator cannot be used 
to determine the status of the pump once that indicator is assumed to have failed. 

Note that over segments G73 to G149 there are many segments differing only in their dis¬ 
junctive values for P7, P8, and P10. This arises when the values of these CHANGE properties 
are close to zero and approaching it. These disjunctive values indicate that the actual values 
may be significantly positive or negative, or they may be zero but the imprecise sensor is not 
giving an exact zero value. 
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Snapshot 1-4: 


Try SENSOR-FAILURE FDC-HYPOTHESIS: 

Forget P4 from <Seg 22> to <Seg 32> ... 

***** <Fir-2 {Forgot P4}> worked! ***** 

111111111122222222223333333333444 

1234S6789012345678901234567890123456789012 P3 P4 P7 P8 P10 


Segl: .#.1... > F 0 0 0 

Seg9: .. #.1... > 0 0 0 

SeglO: ......1.#. > 0 

Segll: .#,.1. > T - + 0 

Segl5: ..—.#1 > T - + 

SeglS: .-..., .1 > T - + + 

Seg22: ....-.-..#.l > - + + 

S«g24: ..#.l > +■ + 

Seg30: .-.-.2.1.#.# + + 

Seg32: .1.#_ (< ■) - + + 

Seg33: .—.#..l_—.- 


Interpretation credibility - 1 369565E-10 (1 9281808E-6 normalized) 
{Normalization under-estimated due to cycles} 

Best interpretation ending in state other than 32 ends in state 29: 
It’s credibility is 1.00 times smaller. 

{cred - 1.3695513E-10 (normalized: 1.928161SE-6)} 


















Snapshot 1-5: Statu* after processing alt observation* 
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{Normalization under-estimated due to cycles} 

Best interpretations ending in states other than state 33: 

End in one of states: (23 28). 

All have credibility 1.06 times smaller. 

{cred ■ 1.9802324E-26 (normalized: 2.793E983E-22)} 










































Final Summary at Snapshot 1-5: 


Global Interpretation: 


From 

0.0 

<Seg 1> to 

5.0 

<Seg 10> 

39 

From 

5,0 

<Seg 11> to 

7.0 

<Seg 11> 

41 

From 

7 * 0 

<Seg 15> to 

14.0 

<Seg 24> 

42 

From 

14.0 

<Seg 30> to - 

15.0 

<5eg 30> 

38 

From 

15.0 

<Seg 32> to 

36.5 

<Seg 74> 

32 

From 

36.5 

<Seg 75> to 

79.5 <Seg 149> 

33 


Number of numerical measurements: 644 

- Single active fix-hypothesis: —- 

<Fir-2 {Forget P4>> for value FALSE 

type: SENSQR-FAILURE; time: 10.0 to 79.5; inconsist-seg: <Seg 32> 
System Run Time * 6.37 seconds 
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B.1.2 Example 2: Miscaiibra ted-Sensors for Water Levels 

In this example, DATMI changes an earlier hypothesis, that a pump indicator has failed, to a 
new hypothesis that the sensors of the water levels in the two cans are miscalibrated. The 
hypothesized failure of the pump indicator must be retracted when the indicator lights up, 
suggesting that the pump is OH, after the indicator light was assumed to have burnt out earlier. 
This retraction is necessary because such a sensor failure is assumed to not be intermittent. 

Snapshot 2-1 - Snapshot 2-4 are the same as Snapshot 1*1 - Snapshot 1 - 4 , except that PlO 
is not observed after G24. Thus, DATMI again initially decides to doubt the pump indicator to 
fix the inconsistency at Gat. 

Snapshot 2 - 1 : INCONSISTENT 

***** Inconsistent segment <Seg 32> detected! 

111111111122222222223333333333444 

123466789012345678901234567890123456789012 P3 P4 P7 P8 PlO 


Segl: .*.1... > F 0 0 0 

Seg9: ..;.1... > 0 0 0 

SeglO: ..1.#. > 0 

Segll: .*.1. > T - + 0 

SeglS: .—.#1 » T - + 

Segl8: .-.1 > T - + + 

Seg22: ..#.l > + + 

Seg24: .-.1.. > F - + + 

Seg30: .-.1.. F - + 

Seg32: ... (< •) F - + 


Seg32: ... (< •) F - + 



Snapshot 2-2: INCONSISTENT 


Tty SENSOB-PAILURE FIX-HYPOTHESIS:. 

Forget PlO from <Seg 15> to <Seg 24> ... 

***** Pinterp-space still inconsistent at <Sag 32>! 

111111111122222222223333333333444 

1234S6789012346678901234667890123456789012 P3 P4 P7 PB PlO 


Segl: .#.1... > F 0 0 0 

Seg9: .#.1... > 0 0 0 

SeglO: .*.#..1.#. > 0 

Segll: .#. ...1. > T - + 0 

SeglS: .—. .#1 > T - + 

SeglS: .—....#1 > T - + 

Seg22: ....##1 > ♦ 

Seg24: ..1„ > F - + 

Seg30: .-.1.. F - + 

Seg32: .... (< -) F - + 
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Snapshot 2-3: INCONSISTENT 


Retract fix-hypothesis <Fix-l {Forget P10>> ... 

***** Retracted fix-hypothesis <Fix-l {Forget P10}>1 ***** 

111111111122222222223333333333444 

123456789012345678901234567390123456789012 P3 P4 P7 P8 P10 


Segl: .#.1... > F 0 0 0 

Seg9: .#.1... > 0 0 0 • 

SeglO: .#.#.1.#. > 0 

Segll: .#.1. > T - + 0 

SeglS: ...—.#1 > T - + 

Segl8: .-.1 > T - + + 

Seg22: ..#.l > - + + 

Seg24: .... -...1.. > F - ♦ + 

Seg30: .-.1.. P - + 

Seg32: .... (< -) P - + 





Snapshot 2 - 4 : 


Try SENSOR-FAILURE FIX-HYPOTHESIS: 

Forget P4 from <Seg 22> to <Seg 32> ... 

***** <Fix-2 {Forget P4}> worked? ***** 

111111111122222222223333333333444 

123456789012345678901234567890123456789012 P3 P4 P7 P8 P10 


Segl: ..#....1... > F 0 0 0 

Seg9: ..*...#.1... > 0 0 0 * 

SeglO: .#.#.1.#. > 0 

Segll: .*.1. > T - + 0 

SeglS: ...--.#1 > T - ♦ 

SeglS: .-.1 > T - + + 

Seg22: ...#.l > + + 

Seg24; .-.-.#.l > - + + 

Seg30: ..—. *..2 -#1.### - + 

Seg32: .#. .1_##_ t< **) + 

Seg33: .....- 


Interpretation credibility - 1.369665E-10 (1.9256245E-6 normalized) 
{Normalization under-estimated due to cycles} 

Best interpretation ending in state other than 32 ends in state 29: 
It's credibility is 1.00 times smaller. 

{cred - 1.3695513E-10 (normalized: 1.92S6051E-6)} 































Snapshot 2-5 shows the situation when F 4 is observed to have value *T* just after G^q. 
This conflicts with the assumption of the active fix-hypothesis that F4 can only be “F” after 
<?S 2 ' Thus, this fix-hypothesis must be retracted* 


Snapshot 2-5: 

***** Active Beneor-fallure hypothesis contradicted! ***** 
Property P4 observed with value ”T” at tine 20*5* 

<Fix-2 {Forget P4}> expected value "FV 

lilium 122222222223333333323444 


Seel: 

1234567890123456789012345678901234S6789012 

_# _1 

P3 

> 

P4 

F 

P7 

0 

P8 

0 

P10 

0 

S®g9: 

.#... 

_i... 

> 


0 

0 

0 

SeglO: 

..... 

* * - *l.i, 

> 




0 

S«gU: 


.1. 

> 

I 

- 

+ 

0 

ScglS: 

* ..— * -. 

.#1 

> 

T 

- 



Sag18: 

* _ 

. 1 

> 

T 

- 

+ 

+ 

Seg22: 

. .*.**-*- . 


> 


- 



Seg24: 

****** .. * 

.•* 1 

> 


- 

+ 


Seg30; 

............#..2.. 




- 

+ 


Seg32: 

...#. .1* . 


(< -) 


- 



Seg33: 

..#. *1. . 


< 


- 

+ 


5eg40: 

. . . 


< 


- 




Interpretation credibility - 1.966S214E-11 (2*7568046E-7 normalized) 
{Normalization under-estimated due to cycles} 

Best interpretation ending in at ate other than 32 ends in state 29: 
It f a credibility is 1*00 times smaller. 

{cred - 1*956501SE-11 (normalized: 2.7S6777E-7)} 


During the course of retracting the fix-hypothesis of forgetting F4, the originally inconsis¬ 
tency at G 53 is again detected at Snapshot 2-6. Now, alternative fix-hypotheses must be tried, 
as Snapshot 2-7 - Snapshot 2-12 illustrate* 

Finally, forgetting the ORDER relation (F3) between the water levels of the two containers 
succeeds in fixing the pinterp-space at Snapshot 2-13. 

Having fixed the inconsistent pinterp-space, the observation of F4 being U T* at the segment 
after G 40 is now asserted, as Snapshot 2-14 shows* 
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Snapshot 2-6: INCONSISTENT 

Retrsct sensor-failure hypothesis <Ftx-2 {Forget P4}> — 

***** Inconsistent segment <Seg 32> detected! ***** 

ill 11U11122222222223333333333444 

1234S678901234S678901234567890123456789012 P3 P4 P7 P8 P10 


Segl: ...#.1— > P 0 0 0 

Seg9: ..#.1... > 0 0 0 

SeglO: .«.•.-. 1 -#- > 0 

Segll: .#.1- > T - + 0 

SeglS: .—.#1 > T - + 

Segl8: .~.1 > T - + + 

Seg22: ....#1 > + + 

Seg24: .-. 1 .. > F - + + 

Seg30: ......1.- F - + 

Seg32: .-—- C< -) + 

Seg33: .# .1. < “ + 

Seg40: .. #-.l. < - + 



Snapshot 2-7: INCONSISTENT 


Try SENSOR-FAILURE FIX-HYPOTHESIS: 

Forget PiO from <Seg 15> to <Seg 24> ... 

***** pinterp-spsce still inconsistent et <Seg 32>! ***** 

minim 22222222223333333333444 

123456789012345678901234567890123456789012 P3 P4 P7 P8 PIO 


Segl: .#.I -- > F 0 0 0 

Seg9: .#.1... > 0 0 0 

SeglO: ..1.#. > 0 

Segll: .#...1. > T - + 0 

Segl5: .—.#1 > T - + 

SeglS: ...—.#1 > T - + 

Seg22: ...#*1 > + 

Seg24: ..-.1-. > F - + 

Seg30: .-.1-. F - + 

Seg32: ..-"- (< -) + 

Seg33: . #-.l . < - + 

Seg40: ..# -l. < - + 































Snapshot 3-8: INCONSISTENT 


Rotract fix-hypothoaia <Fix-3 {Forgot P10>> _ 

***** Rotractad fix-hypothosia <Fix-3 {Forgot P10}>l ***** 

111111111122222222223333333333444 

123456789012345678901234567890123456789012 P3 P4 P7 P8 P10 


Sogl: .#....1... > F 0 0 0 

Sog9: ...1... > 0 0 0 

SoglO: .#.#.1.#. > 0 

Sogll: ..#.1. > T - + 0 

Sogl5: .. —.#1 > T - + 

Sogl8: ...-.1 > T - ♦ + 

Sog22: ....#.l > + + 

Sog24: .-.1.. > F - + + 

Sog30: ...1.. F - + 

Sog32: .(< -) - ♦ 

Sog33: . #..l . < - + 

Sog40: . #..l. < - + 


Sog32: .(< -) ♦ 

Sog33: . #..l . < - + 

Sog40: . #..l. < - + 



Snapshot 3-9: INCONSISTENT 


Try SENSOR-FAILURE FIX-HYPOTHESIS: 

Forgot P8 from <Sog 10> to <Sog 40> ... 

***** Pintorp-spaco atill inconaiatent at <Seg 32>! ***** 
111111111122222222223333333333444 

123456789012345678901234567890123456789012 P3 P4 P7 P8 P10 


Segl: .*. 1... > F 0 0 0 

S*g9: .#... 1... > 0 0 0 

SoglO; .#.#.1.#. > 0 

Sogll: .».1. > T - 0 

SoglS; .—.#1 > T 

SeglS: .-.1 > T - + 

Seg22: ..#.l > - + 

Seg24: ..1.. > F - + 

Sog30: .-..1.. F 

Seg32; ._—_ (< -) 

Sog33; . #..l . < 

Sog40; . #..l. < 

































Snapshot 2-10: INCONSISTENT 


Retract fir-hypothesis <Fir-4 {Forget P8>> ... 

***** Retracted fir-hypotheais <Fix-4 {Forget P8>>! **••• 

U1U1U1122222222223333333333444 

• 12345678901234567890123456789012346678Q012 P3 P4 P7 P8 P10 


Segl: .#.1... > F 0 0 0 

Seg9: .•.1... > 0 0 0 

SeglO: ..#.#.1.*. > 0 

Segll: .*.1. > T - + 0 

SeglS: .■-.#1 > T - + 

SeglS: .-.1 > T - + + 

Seg22: ..#.l > + ♦ 

Seg24: .-.1.. > F - + + 

Seg3Q; .-.1.. F - + 

Seg32: .._ (< -) - + 

Seg33: . #..l. . < - 

Seg40: ..1.. < - + 



Snapshot 2-11: INCONSISTENT 


Try SENSOR-FAILURE FIX-HYPOTHESIS: 

Forget P7 from <Seg 10> to <Seg 40> ... 

***** Pinterp-space still inconsistent at <Seg 32>! ***** 
111111111122222222223333333333444 

123456789012345678901234567890123456789012 P3 P4 P7 P8 P10 


Segl: ..1... > F 0 0 0 

Seg9: .#...1... > 0 0 0 

SeglO: .#.*...i.#. > 0 

Segll: ..*.1. > T + 0 

SeglS: .—.#1 > T + 

SeglS: .-.1 > T + + 

Seg22: ..#.l > + + 

Seg24: .-.1.. > F + + 

Seg30: ......1.. F + 

Seg32: .-,.--—_ (< -) + 

Seg33: 6 • * 1. *«*»• ■ • ^ + 

Seg40: .„. #..l. < + 
































Snapshot 2-12: INCONSISTENT 

Ketrsct fix-hjpothtiii <Fix-S {Forget P7}> ... 

Rstrseted fix-hypothesis <Fix-5 {Forget P7}>! 


111111111122222222223333333333444 
123456769012346678901234567890123456789012 P3 


Ssgl: ..#.1... > 

Seg9:_*.#.I... > 

SsglO: .#.#.1.#. > 

Segll: .*.1. > 

SeglS; ,.*.. *, ».■*, * * •..*... .#1 > 

3egl8: . 1 > 

Seg22: .-*. 1,1 > 

Seg24: ..1.. > 

Seg30: ..-...1.. 

Seg32: ......-(< -) 

5eg33: .....1. < 

Seg40: ,. ........... < 


P4 

F 


T 

T 

T 

F 

F 


P7 P8 P10 

0 0 0 

0 0 0 

0 

+ 0 

+ 

- + + 

+ + 

- + ♦ 

+ 

+ 

+ 

+ 


Snapshot 2*13: 


Try SENSOR-FAILURE CALIBRATION FIX-HYPOTHESIS: 
Forget P3 from <Seg 1> to <Seg 40> .,. 

***** <Fix-0 {Forgot P3}> worked! ***** 


111111111122222222223333333333444 
1234 56789012345678901234S678901234567TO012 P3 P4 P7 


Segl: ....“..I.-. F 0 

Se g9 « * * # * ,,*.^*,,1. 0 

S*glO: —-. . .--O s.-e-ole#. 

Segll: ...___#.-.-...1. T 

SeglS: ..—.— .,#1 T 

Segl8: ...-.-...1 T 

Seg22 : ...._-.#.1 

Seg24 : .... ...-...1.. F 

Seg30: .........I.. F 

Seg32: .. 

Seg33: ......._##.l## 

Seg40: ....... 


Interpretation credibility - 5.8700926E-11 (8*33073S6E-7 normalized) 
{Normalization under-estimated due to cycles} 

Best interpretation ending in state other than 40 ends in state 42: 
It's credibility is 1.00 times smaller. 

{cred - S.B70034E-11 (normalized: 8.3306S3E-7)} 


P8 P10 

0 0 

0 0 

0 

+ 0 

+ 

+ + 

+ + 

+ 

♦ 


4 
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Snapshot 2-14: 

***** Retracted contradicted fir-hypothesis <Fix-2 {Forget P4}>! ***** 


111111111122222222223333333333444 

123456789012345678901234567890123456789012 P3 P4 P7 P8 P10 

Segl: .. #.....— ..1... F 0 0 0 

Seg9■ ■•■■.•.4-».——..1**# 0 0 0 

SegiO- ————— ■ * • « »* F.. -———... —. —— .1*#. 0 

Segll: ..-.-...1. T - + 0 

* SeglS: ...—.-— ..#1 T - + 

SeglS: ..".-.-...1 T - + + 

Seg22: ..-.-.#.1 - + + 

Seg24: .-.1.. F “ + + 

Seg30: .-.1.. F - + 

Seg32: ....1.. F - + 

Seg33: .-. ........1.. F - + 

Seg40: ..... #..# _##.##1 - + 

Seg43: .—. #..# _##..#! T - + 


Interpretation credibility ” 8.385762E-12 (1.1906554E-7 normalized) 

{Normalization under-estimated due to cycles} 

Beat interpretation ending in state other than 42 ends in state 41: 

It’s credibility is 1.00 times smaller. 

{cred - 8.385678E-12 (normalized: 1.19064346E-7)} 

The rest of the observations are asserted without difficulty, resulting in Snapshot 2-15. Note 
that Gui is a gap-fill segment 3ince no observations are observed during that time interval. 
However, even with no property constraints for Cjji, almost half of its pinterps are INACTIVE 
because there are no valid dependency paths for them. 















































B.2 Handling Sensor Failures with Property Probabilities 

B.2.1 Example 3: An Unlikely Failure of the Pump Indicator 

The same observations are used for this example as for Example 1. However, the quantity-space 
conversion tables for this example assign some non-zero probability to every possible value for 
property P 4 , They also avoid asserting that P7 or P 8 ever have value 0 without also admitting 
that they might be somewhat postive or negative instead. 

These quantity-space conversion tables indicate that when the pump indicator says the 
pump is OFF, then believe that the pump is actually OFF with confidence 0.99 and that the 
pump is OK with confidence 0,01. Thus, when the pump must actually be ON at some point 
where the indicator claims it is OFF, there will still be a global interpretation, of rather low a 
priori probability, that the pump is ON. 

Snapshot 3-1 shows the pinterp-space resulting from using this alternative quantity-space 
conversion table. In £?s 2 , the value of “T” for P4 allows ACTIVE pinterps P(G32,5s2) and 
P(G$2i ^ss)- is the a priori more plausible value for P4 in because the indicator claims 
the pump is OFF for G 22 - However, the availability of the value for P4 for G 32 allows DATMI 
to avoid the process of hypothesizing and testing fix-hypo theses that was used in Example 1 , 

As should be expected, the pinterp-space of Snapshot 3-1 is more general than the pinterp- 
space of Snapshot 1-5. The sets of ACTIVE and INACTIVE pinterps of Snapshot 3-1 properly 
contain the respective sets of Snapshot 1-5. This results from the more general quantity-space 
conversion table for this example. 
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Snapshot 3-1: Status after processing all observations 


U1111U1123222222223333333333444 
123466789012345678901234567890123456789012 


Segl 


• •see. 


#># . 

..see* 


> 

(F T) 





0 

Segll 




ee#. 

...*•*.*•»* 

„M.l. 

> 

(T F> 

- 


+ 


0 

SeglS 





a..*******. 

_##1 

> 

(T F) 

- 


+ 



Segl8 





........... 

.. ..#.1 

> 

(T F) 

- 


+ 


+ 

Segl9 




, , . 

... 

.. ..#.1 

> 

(T F) 

- 


+ 


+ 

Seg24 






_1.# 

> 

(F T) 

- 


+ 


+ 

Seg30 





. ..# . * . 



(F T) 

- 


+ 


+ 

Seg32 




.**-*•*• 

-2... 

..1_ 

(< -) 

(F T) 

- 


+ 


4 

Seg33 




.. 

..l.e . 


< 

(F T) 

- 


+ 


+ 

Seg62 





*ee.#..1... 


< 

(F T) 

- 


+ 

(+ 

0) 

Seg74 




. . . 

. • t .1. .t. . . 


< 

(F T) 

- 

<+ 0) 

(+ 

0) 

Seg75 





...1#..##.. 


< 

(F T) 

C- 0) 

(♦ 

0) 

<♦ 

0) 

Seglll 







< 

(F T) 

(- 0) 

(+ 

0) 


0 

Segl12 


..«##. 





< 

(F T) 

(- 0) 

(+ 0) 

(- 

0) 

Segl13 



*..##. t « 

_-1#, 



< 

(F T) 

C- o) 

(+ 

0) 



Segl15 



. e .##. a e 




< 

(F T) 

<- 0) 

(+ 

0) 

(+ 

0) 

Segl16 





aae##...#.. 


< 

(F T) 

(- 0) 




0 

Segl17 



.. 

_-i#e 



< 

(F T) 


(+ 

0) 


0 

Segl18 




_-1#. 



< 

(F T) 

(- 0) 

(♦ 

0) 


0 

Segl19 




--l#e 

e . 


< 

(F T) 





0 

Segl20 



. - .##. .. 


.. . 


< 

(F T) 

(- 0) 



(+ 

0) 

Segl21 


,."ft. 


_-l#e 



< 

(F T) 


(+ 

0) 

(+ 

0) 

Segl22 



^## 

_ -l#e 



< 

(F T) 




(+ 

0) 

Segl23 





J1 II Trlr tt TT TT * 


< 

(F T) 






Segl24 


e 

...##... 

_ -l#e 



< 

(F T) 

(- 0) 



(- 

0)' 

Segl25 



. . .##- * * 

_ "l#e 



< 

(F T) 


(+ 0) 


0 

Segl26 




- -1#, 

,..#.. 


< 

(F T) 





0 

Sag129 




_"I#, 



< 

(F T) 

(- 0) 

(+ 0) 


0 

Segl30 




_ -1 *. 



< 

(F T) 





0 

Segl37 




..,.-11, 

## # 

* ■ 4 li If 4 * * It - - 


< 

(F T) 

(- 0) 

(+ 

0) 


0 

Segl38 




_"I#. 

aa~##e».#.. 


< 

(F T) 





0 

Segl47 




_ “l#a 



< 

(F T) 




(t 

0) 

Segl49 



. * 


a,-##...#-. 


< 

(F T) 





0 


Interpretation credibility “ 3.049393E-33 (8.797574E-31 normalized) 
{Normalization under-estimated due to cycles} 

Best interpretation ending in state other than 22 ends in state 28: 
It's credibility is 1.00 times smaller. 

{cred - 3.0493626E-33 (normalized: 8.797485E-31)} 










































Final Summary at Snapshot 3-1: 


Global Interpretation: 


From 

0.0 

<S«g 1> to 

5.0 

<Sag t>: 

39 


From 

S.O 

<Seg 11> to 

7.0 

<S«g 11>: 

41 


From 

7.0 

<S«g 15> to 

11.0 

<S«g 19>; 

42 


From 

ii.o 

<Seg 24> to 

14.0 

<3eg 24>: 

40 


From 

14,0 

<Sag 30> to 

15.0 

<Seg 30>: 

42 


From 

15.0 

<Seg 32> to 

15.5 

<S*g 32>: 

38 

32 

From 

IS. 5 

<Seg 33> to 

36.0 

<Sag 62>: 

32 


From 

36.0 

<Sag 74> to 

36.5 

<Seg 74>: 

29 


From 

36.5 

<Seg 75> to 

54.5 

<S«g 7S>: 

28 

22 

From 

54.5 <Seg 111> to 

79.5 

<S«g 149>: 

22 



Number of numerical measurement a: 644 

System Run Time » 6.ST seconds 
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B.3 Noticing State-Duration Conflicts 

B.3.1 Example 4: Drainage Taking Longer Than Expected 

tn this example, DATMX initially believes that water is continuously draining from a container. 
However, when the water flow from this container lasts longer than the maximum time required 
to drain a full container of water, DATMX changes its best interpretation to one where the valve 
is not OPEN for so long. 

Domain-specific state-duration information indicates that a state cannot persist for more 
than 125 seconds when flow occurs through the pipe but no pumping occurs. Similarly, a state 
can persist for at most 65 seconds when pumping occurs but no flow through the pipe occurs. 
These upper bound state-durations are based on knowledge about how long it takes for a full 
container of water to drain or to be pumped dry. 

At Snapshot 4-1, it is consistent that the water has been draining for the last 50 seconds in 
state S 4 Q. This is because DuIS+q) = 125, according to the above domain-specific state-duration 
information, and 125 > 50. 


Snapshot 4-1: Through time = 50 seconds 

UllUll 1122222222223333333333444 

123456739O1234567890123456789O123456739012 P4 P5 P7 P8 

Segl: .*.#....1*. F T * + 

Seg4; --—..##..#1.. F 

Interpretation credibility - 0.0060430258 (0.28767118 normalized) 

Best interpretations ending in states other than state 40: 

End in one of states: (39 36). 

All have credibility 1.00 times smaller. 

{cxed - 0.006042965 (normalized: 0.28766832)} 


At Snapshot 4-2, state S+q may still be spanning for the entire 100 seconds since Djj(Sin) 
= 125 > 100. 


Snapshot 4-2: Through time — 100 seconds 

111111111122222222223333333333444 

1234S6789012 34S678901234567890123456789012 P4 P5 F7 PS 


Segl; .*--#.*..1.. F T - + 

5eg4; .--—..-*..##, .#1, . F 


Interpretation credibility - 0.0060430258 (0.28767118 normalized) 
Best interpretations ending in states other than state 40: 

End in one of states: (39 36). 

All have credibility 1.00 times smaller. 

{cred - 0.006042965 (normalized: 0.28766832)} 


However, at Snapshot 4-3, the pump-cycle cannot span with S 4 Q for the entire 140 seconds 
since = 125 < 140. Thus, P{G 10 , £ 40 ) cannot b-depend on The best global 

interpretations becomes the ones ending at P(Gi 6 , Sze) and P(Gi 0 , 53 a). These interpretations 
still start at P(Gi,S 4 o), but they do not span all the segments with S 40 , The best global 
interpretation ending at PfG^Sse) passes through PfG^Sse) because it is more plausible to 
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stay in the same state for both G 4 and G ie- Similarly, the beet global interpretation ending at 
F(Gi6,5ot) passes through P(C? 4 ,S$ 9 ), 


Snapshot 4-3: Through time — 140 second* 


111111111122222232223333333333444 

123466789012345678901234567890123466789012 P4 PS PT P8 

Segl: *....#.*.1.. F T * + 

Seg4* ™****** * »* * * * * ptl* * 99 * * F 

Segl6: --,*...—--.-#1. F 


Interpretation credibility ■“ 0*001208593 (0.10613848 normalized) 
{Normalization under-estimated due to cycles} 

Best interpretation ending in state other than 36 ends in state 39: 
This alternative interpretation has the same credibility* 


At Snapshot 44, the best global interpretation goes through F(Gxe, S 40 ) instead of FfGxg, 5^), 
as it did for Snapshot 4-3* This is because the observations for G 21 make F(Gi 3 , 5 se) INACTIVE 
because there is no transition consistency relation between F{Gisi^ss) G 21 - is a state 
where the two water levels are equal and the pump is OFF* So, it is not possible for the water 
levels to change after being in state Sse unless the pump is turned ON* Since the pump is OFF 
in G 21 , P(G 16 , S$%) must be INACTIVE. 


Snapshot 4-4: Status after processing all observations 

111111111122222222223333333333444 
12345678901234S6T8901234567890123456789012 P4 PS 

Segl: - *-**-#.*--1*- F T 

Seg4' —— * * ——******* ■ ■ * - ** -- ™ ******** —— * * 16 * * F 

Segl6: ——* .——————* * > * * * — — * ■ ——— ~ ( * t F 

Seg21: .*. -,.* ... 1.* F T 

Interpretation credibility m 1.726544E-4 (0.081958115 normalized) 
{Normalization under-estimated due to cycles} 

No interpretation ends in a different state! 


P7 P8 

- + 




Final Summary at Snapshot 4-4; 


Global Interpretation: 


From 

0.0 

<Seg 1> 

to 

7.0 

<Seg 1>: 

40 

From 

7.0 

<Seg 4> 

to 

120.0 

<Seg 4>: 

39 

From 

120.0 

<Seg 16> 

to 

200.0 

<Seg 21>: 

40 


Number of property assertions: 41 

System Run Time m 5*17 seconds 
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APPENDIX C 


THE FROB SINGLE-WELL 
TOTAL ENVISIONMENT 


This appendix describes the single-well model used for the DATMI examples show in Appendix D. 
As shown in Figure 0.1, this single-well system consists of nine outer wall segments (labelled 
S19, SIS, SIT, S16, SIS, S14, 378, S79, S12). This system includes a narrow well formed by 
the walls S17, SI6, and SIS. The behavior of this system is represented by the movement of a 
ball within these boundaries. This system was modelled with FROB (Forbus, 1981) to provide a 
total environment of all such behaviors. 

Describing the properties for all 360 states of the total environment for this single-well 
system would take too much space here. Therefore, descriptions of particular states will he 
provided as needed in the examples of Appendix D. Each location in the single-well system is 
either a SREGION or SEGMENT. A SREGION, abbreviated as SR in Figure C.l, describes a non¬ 
empty area of space. Alternatively, a SEGMENT, abbreviated as S, indicates either a wall surface 
or an imaginary border between two SREGXOlTs. Qualitative values (nil, up, down, left, and 
right) for both the horizontal and vertical directions indicate the motion of the ball during each 
state. During a particular state, the ball can either collide with a wall, fly from a SEGMENT or 
through a SREGION, pass through an imaginary border, stop at a wall, or fall outside of the 
system. Transitions among ail the states of the total envisionment are indicated by Figure C.2. 
As can be seen in this figure, this is a rather large envisionment. It has 484 state transitions 
among 360 states. 
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APPENDIX D 


DATMI EXAMPLES FOR THE 
FROB SINGLE-WELL SYSTEM 


For these examples, DATMI used the total envisiomnent described in Appendix C. For each 
example, this appendix describes the status of the pinterp-space using the snapshot represen¬ 
tations introduced in Appendix B. However, because the single-well envisionment is so large, 
the snapshots of this appendix mention only those states which, are COMPATIBLE in at least one 
segment. 


D.l Maintaining the Most-Probable Interpretation 

D.l.l Example 5: Three Collisions 

In this example, DATMI observes three successive collisions of the FROB ball. After just observing 
the first collision, DATMI suspects that the ball hit the largest wall since that is the a priori most 
likely wall to be hit. After observing the second collision, the working interpretation is adjusted 
so that the ball hits that largest wall at the second collision. This is necessary since the second 
collision could not be explained if the ball hit the largest wall first. Alternative interpretations 
where the ball hits a wall far from the wall that was first hit involve long sequences of states 
indicating movement through many imaginary borders. Since there are many ways for the ball 
to move through the space between far walls, the probability of each such sequence is relatively 
small. Thus, smaller sequences tend to be the best working interpretation, as is the case here. 
Finally, the third observed collision results in a working interpretation where the largest wall 
is not hit at all. 

Snapshot 5-1 shows that DATMI initially believes that the ball probably hit S14. Property 
P2 is the horizontal (x) direction (Right or Left) of the ball, P3 is the vertical (y) direction 
(Up or Down), and F4 is the action of the ball (Fly, Collide, Pass, etc.). Descriptions of the 
key states for a pinterp-space are shown at the end of the snapshot. The first section of these 
state descriptions summarize the best working interpretation. The second section describes 
some interesting states of alternative interpretations. 

Domain-specific rules compute higher probability for states where the ball is at S14 than 
for states where the ball is at some other wall. These rules basically assign a priori state 
probabilities proportional to the area of the ball location specified by the states. However, they 
also take into consideration the relative difficulty of reaching each state. Thus, states where 
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the bell is in the narrow well ere not as likely as one would expect based solely on the rather 
long lengths of the well walla. 


Snapshot 5-1: Through time = t second* 

11111111122222323333333 
3345667701123344545567800123445 

0863088952841739510087654321008 P2 P3 P4 

Segl: _-####-#1- RDF 

SE62: #1##.##.#*. ROC 

Interpretation credibility ■ 6.452681775320S79d-S 

Best interpretation ending in state other than 38 ends in state 105: 
It’s credibility (3.970881022884232d-5) is 1.63 tines smaller. 


State 295: PLACE - SRECI0N2, VX - RIGHT, VY - DOWN, ACTION - FLY 
State 38: PLACE - SEGMENT14, VX - RIGHT, VY - DOVN, ACTION - COLLIDE 


State 106: PUCE - SEGHENT78, VX - RIGHT, VY - DOWN, ACTION - COLLIDE 


Hitting S78 was not considered as likely as hitting S14 at Snapshot 5-1, due to the relative 
lengths of those two walls. However, at Snapshot 5-2, hitting S14 for the first collision is not 
possible any more because the ball could not then be moving left and down at the second 
collision, as required by segment G A . Thus, the best working interpretation at this point is 
hitting S78 first, and then hitting S14. 

After observing all three collisions at Snapshot 5-3, DATMI realizes that the ball must hit 
either S19 or S17 for the third collision. Since S17 is in the well, the ball will more likely hit 
S19. Although hitting S14 at the second collision is possible (since P((? 4 ,S 33 ) is ACTIVE), the 
domain knowledge suggests that it is a little more likely to go from S78 to S19 directly. 

The best interpretation contains a hidden-transition of eight states across segment G 3 . The 
movement of the ball from S78 to S19 is largely unconstrained by the observations for G 3 . This 
situation illustrates the need for efficient hidden-transition search. 

Some alternative interpretations suggest that the ball may have been in the well for part of 
the time. It may have bounced around in the well for all three collisions or it may have just 
fallen into the well for the last two collisions. In either case, the probability of falling into the 
narrow well is very low. As Snapshot 5-3 shows, interpretations where the ball fell into the well 
are at least 83.58 times less likely than the best interpretation. Thus, interpretations where the 
ball is in the well are considered highly unlikely, although they are still considered consistent. 
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Snapshot 5-2: Through time = 6 seconds 


111111111111111111111111222222222 
11233344455666777889OO011223333444555667889901122344S 
1739603815836038189395158284713793591573951739617396140 P2 


Segl: ..#....#.# R 

SEC2: ..1.#.. r 

Seg3: ####-#.-#.#. L 

SEG4: --.1. . L 


222222222223333333333333 
556677888990011223344455 
392817069584736261403928 
Segl: 1.- 

SEG2: . 

Seg3: #.#.-.-.2.-.#.#.-.-.*.#. 

SEG4: . 

Interpretation credibility ■ 4.941192348422297d-9 

Beat interpretation ending in state other than 33 ends in state 63: 

It * a credibility (9.1701425SS638645d-15) is 538834.85 tinea smaller. 


P3 P4 

D F 

D C 

D (F P) 
D C 


State 

295: 

PLACE 

- 

SREGX0N2, 

VX 

m 

RIGHT, 

VY 

m 

DOWN, 

ACTION 


FLY 

State 

105: 

PLACE 

- 

SECMENT78, 

vx 

m 

RIGHT, 

VY 

m 

DOWN p 

ACTION 

* 

COLLIDE 

State 

101: 

PLACE 

- 

SEGMENT73, 

VX 

m 

LEFT, 

VY 

m 

DOWN, 

ACTION 

• 

FLY 

State 

289: 

PLACE 

m 

SREGI0N2, 

vx 

m 

LEFT, 

VY 

m 

DOWN, 

ACTION 

m 

FLY 

State 

33: 

PLACE 

on 

5EGMENT14, 

vx 

m 

LEFT, 

VY 

m 

DOWN, 

ACTION 

* 

COLLIDE 


State 63: PLACE - SEGMENT18, VI - LEFT, VY - DOWN. ACTION - COLLIDE 
















Snapshot 5-3: Status after processing all observations 


111111111111111111 
111222333344445565666677777888999000011122333344455 
1278349057035813580368035813489359067135802847137935915 P2 P3 P4 

Segl: ...#.-.RDF 

3EG2: ...1..#. R D C 

Seg3: #.#.#.#.#.-.#.-.1..#_L D (F P) 

SEG4: ..#..-..#..1.. L D C 

SegS: .#.. .1. . L U (F P) 

SEG6: .#.1. L U C 



7935915713793591571278349057146O3&9248137O269158O4793682571460359248 
Segl: ..*..1. 

SEG2: .... 

Seg3: 7.5.3.8..6..2..-..#..4.. 

SEG4: . 

Seg5: .2. 

SEG6: .. 

Interpretation credibility - 1.62381396704618S4d-20 

Beet interpretation ending in atate other than 73 ends in state 58: 

It'a credibility (1.9428988031530713d-22) is 83.58 tinea smaller. 


State 

295: 

PLACE 

m 

SKEGI0N2, 

VI 

m 

RIGHT, 

VY 

• 

DOWN, ACTION 

m 

FLY 

State 

105: 

PLACE 

m 

SEGMENT78, 

vx 

m 

RIGHT, 

VY 


DOWN, ACTION 

m 

COLLIDE 

State 

101: 

PLACE 

m 

SEGMEMT78 f 

vx 

m 

LEFT, 

VY 

Mi 

DOWN, ACTION 

m 

FLY 

State 

289: 

PLACE 

m 

SREGI0N2, 

VI 

m 

LEFT, 

VY 

m 

DOWN, ACTION 

- 

FLY 

State 

193: 

PLACE 

m 

SEGHENT93, 

vx 

m 

LEFT, 

VY 

S 

DOWN, ACTION 

* 

PASS 

State 

316: 

PLACE 

m 

SREGI0N5, 

vx 

m 

LEFT, 

VY 

m 

DOWN, ACTION 

* 

FLY 

State 

175: 

PLACE 

Mi 

SEGMENT90, 

vx 

m 

LEFT, 

VY 

m 

DOWN, ACTION 

- 

PASS 

State 

262: 

PLACE 

m 

SREGIDN11, 

vx 

m 

LEFT. 

VY 

a 

DOWN, ACTION 

* 

FLY 

State 

157: 

PLACE 

m 

SEGMENTS?, 

vx 

m 

LEFT, 

VY 

Ml 

DOWN, ACTION 

- 

PASS 

State 

253: 

PLACE 

m 

SREGIDN10, 

vx 

m 

LEFT, 

VY 

m 

DOWN, ACTION 

- 

FLY 

State 

71: 

PLACE 

m 

SEGMENT19 , 

vx 

m 

LEFT, 

VY 

m 

DOWN, ACTION 

- 

COLLIDE 

State 

74: 

PLACE 

m 

SEGMENT19, 

vx 

m 

LEFT, 

VY 

Ml 

UP, ACTION 

- 

FLY 

State 

255: 

PLACE 

3 

SREGI0N1Q, 

vx 

m 

LEFT, 

VY 

■a 

UP # ACTION 

- 

FLY 

State 

73: 

PLACE 

m 

SEGMENT19, 

vx 

m 

LEFT, 

VY 

m 

UP, ACTION 

* 

COLLIDE 

State 

58: 

PLACE 

m 

SEGMENT17, 

vx 

m 

LEFT, 

VY 

m 

UP, ACTION 

4 

COLLIDE 
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Final Summary at Snapshot 5-3: 


Global Interpretation: 


From 

0.0 

<S*g 1> to 

2.0 

<Seg 1>: 

295 

From 

2.0 

<Seg 2 > to 

2.0 

<Seg 2>: 

105 

From 

2.0 

<Seg 3> to 

6.0 

<Seg 3>: 

101 289 193 316 175 262 157 253 

From 

6.0 

<Seg 4> to 

6.0 

<Seg 4>: 

71 

From 

6.0 

<Seg 5> to 

8.0 

<S«g S>: 

74 255 

From 

8.0 

<Seg 6> to 

8.0 

<Seg 6>: 

73 


Number of property assertions: 18 

System Run Time * 30,81 seconds 
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D.2 Noticing Reach-Duration Conflicts 

D.2,1 Example 6; Three Collisions - With Duration Constraints 

The same behavior is observed here as for Example 5, except that duration constraints are 
enforced. For the first two collisions, the best working interpretations are identical to those 
in Example 5, However, after the third collision the best interpretation consistent with the 
duration estimates is that all three collisions occur inside the well. The interpretation sug¬ 
gested for Example 5 contradicts the domain-specific duration estimates indicating that the 
ball cannot move from S14 or S78 to S19 in the short period of time between collisions. As this 
example shows, recovery from a garden-path interpretation, which would typically require much 
backtracking, can be handled relatively efficiently by dynamically adjusting the pinterp-space. 
The first collision is interpreted just as in Example 5, leading to Snapshot 6-1, 


Snapshot M: Through time ^ 2 seconds 


11111111122222223333333 
3345667701123344545567890123445 

0853088952841739510987654321098 P2 P3 P4 

S«gl: _#. -####-#1- RDF 

SEG2: #1##,##,##... R D C 


Interpretation credibility ■ 6,4S2681775320679d-5 

Beet interpretation ending In state other than 38 ends in state 105; 
It's credibility (3,970881022S84232d-5) is 1.63 times smaller. 


State 295: PLACE - SREGI0N2, VI - RIGHT, VY - DOWN, ACTION - FLY 
State 38: PLACE - SEGMENT14, VI - RIGHT, VY - DOWN, ACTION - COLLIDE 


State 106: PLACE - SEGMENT78, VI - RIGHT, VY - DOWN, ACTION » COLLIDE 


After the second collision, the pinterp-space is still quite similar to that of Example 5 . 
However, the duration constraints cause many pinterps that are ACTIVE in Snapshot 5-2 to 
become INACTIVE in Snapshot 6-2. Nevertheless, the best working interpretation is identical 
for both Snapshot 6-2 and Snapshot 5-2. 

Finally, when the third collision is observed, only interpretations where the ball bounces 
inside the well are consistent with the duration estimates. For example, the domain-specific 
knowledge indicates that moving from a state where the ball is at S14 to a state where the ball 
is at S19 requires at least 4 seconds. This bound is derived from the geometry of the system 
along with a particular maximum energy bound for the ball. Since DURATI0N(G 5 ) is only 2 
seconds, such movement cannot occur over G s . Similarly, DUEATIONfG^ is only 4 seconds but 
movements from S78 to S19 directly are known to take at least 13 seconds. Thus, the hidden- 
transition paths for G 3 or G$ in Snapshot 5-3 allowing interpretations where the ball is outside 
of the well are all inconsistent with the duration estimates. 

Note that the only alternative to the best interpretation for Snapshot 6-3 is the interpreta¬ 
tion starting at S17 instead of inside SRO. However, the domain-specific rules indicate that it 
is a priori more likely for the ball to be at SRO at any given time than at S17. 
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Snapshot 6-2: Through time — 6 seconds 


111111111111111111111111222222222 
11233344455666777889000112233334445556678899011223445 
1739503815836038189395158284713793691573951739517395140 P2 P3 P4 


Segl: .#_-..RDF 

SEG2: ..1.-. R D C 

Seg3:--#..1.-..-L D (F P) 


SEG4: _-.1. ... L D C 

55667788899001122334445 5 
392817069584736251403928 
Segl: -.1.- 

SEG2: ... 

Seg3: -.-.-.-.2.-.-.-.-,-.-.-. 

SEG4: . 

Interpretation credibility * 4.941192348422297d-9 

Best interpretation ending in state other than 33 ends in state 56: 

It's credibility (2.8408644649021312d-18) is 1739327028.61 tines smaller. 


State 

295 : 

PLACE 

m 

SREGI0N2, 

VX 

K 

RIGHT, 

VY 

m 

DOWN, 

ACTION 

m 

FLY 

State 

105: 

PLACE 

m 

SEGMENT?8, 

vx 

m 

RIGHT, 

VY 

m 

DOWN, 

ACTION 

- 

COLLIDE 

State 

101: 

PLACE 

m 

SEGMENT?8, 

VX 

m 

LEFT, 

VY 

m 

DOWN, 

ACTION 

- 

FLY 

State 

289: 

PLACE 

m 

$REGIONS, 

vx 

* 

LEFT, 

VY 

m 

DOWN , 

ACTION 

- 

FLY 

State 

33: 

PLACE 

m 

SEGMENT14, 

vx 

m 

LEFT, 

VY 

m 

DOWN , 

ACTION 

- 

COLLIDE 

State 

56: 

PLACE 

m 

SEGMENT17, 

vx 


LEFT, 

VY 

- 

DOWN , 

ACTION 

- 

COLLIDE 
















Snapshot 6-3: Status after processing all observations 


1U1UU1111111111 
111222333344445555666677777888990000011122333344455 
1278349057035813580368035813489359057135802847137935915 P2 P3 

Segl: .#.-.R D 

SEG2: . -..-..1..- .... R D 

S*g3: . 1... .__ l Q 

SEG4: ...1. . t D 

Seg5: 1.. L U 

SEG6: .*.1.. t U 

55666777888899900011112223334445555666777888899900001112223334444555 
79359157137935915712783490571460359248137026916804793682571460359248 
Segl: .1.. 

SEG2: . 

S«g3: -.-.-.-.-.-.-.-.-.-.-.--. 2 .- 


3 P4 
D F 
D C 
D (F P) 
D C 
U {F P) 
U C 




Interpretation credibility - 1.9428988031530713d-22 
No interpretation ends in a different state. 1 


State 

241; 

PLACE 

m 

SREGIONO, 

VX 


RIGHT, 

VY 

- 

DOWN, 

ACTION 

• 

FLY 

State 

45: 

PLACE 

'A 

SEGNENT15, 

VX 

m 

RIGHT, 

VY 

m 

DOWN, 

ACTION 


COLLIDE 

State 

41: 

PLACE 

m 

SEGMENT15, 

VX 

m 

LEFT, 

VY 

m 

DOWN, 

ACTION 

- 

FLY 

State 

235: 

PLACE 

m 

SREGIONO, 

VX 

■m 

LEFT, 

VY 

- 

DOWN. 

ACTION 

- 

FLY 

State 

48: 

PLACE 

m 

SECMENT16, 

VX 

m 

LEFT, 

VY 

- 

DOWN, 

ACTION 

- 

COLLIDE 

State 

SO; 

PLACE 

m 

SEGMENT16, 

VX 

m 

LEFT, 

VY 

- 

UP, 

ACTION 

- 

FLY 

State 

237: 

PLACE 

- 

SREGIONO, 

VX 

m 

LEFT, 

VY 

- 

UP, 

ACTION 

• 

FLY 

State 

58: 

PLACE 

- 

SEGHENT17, 

VX 

m 

LEFT. 

VY 

m 

UP. 

ACTION 

- 

COLLIDE 


State 60: PLACE - SEGMENT17. VX - RIGHT, VY - DOWN, ACTION - FLY 



Final Summary at Snapshot 6-3: 


Global Interpretation: 


From 

0.0 

<Seg 1> to 

2.0 

<Seg 1>: 

241 

From 

2,0 

<Seg 2> to 

2.0 

<Seg 2>: 

4S 

From 

2.0 

<Seg 3> to 

6.0 

<Seg 3>: 

41 23S 

From 

6-0 

<Seg 4> to 

6.0 

<Seg 4>: 

48 

From 

6.0 

<Seg 5> to 

8.0 

<Seg 5>: 

SO 237 

From 

8.0 

<Seg 6> to 

8.0 

<Seg 6>: 

58 


Number of property assertions: 
System Run Time “ 30.84 seconds 
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